AWS Certified Solutions Architect Professional Practice Exam

Practice Test 6: AWS Certified Solutions Architect Professional
Open

Practice Test 5: AWS Certified Solutions Architect…

Finish course

Set a certification due date

AWS Certified Solutions Architect – Professional

Course content

AI Assistant

Practice tests

Start

Practice Test 1: AWS Certified Solutions Architect Professional

Start

Practice Test 2: AWS Certified Solutions Architect Professional

Start

Practice Test 3: AWS Certified Solutions Architect Professional

Start

Practice Test 4: AWS Certified Solutions Architect Professional

Start

Practice Test 5: AWS Certified Solutions Architect Professional

Start

Close panel

Overview

Q&AQuestions and answers

Notes

Announcements

Reviews

Learning tools

Search course content

Start a new search

To find captions, lectures or resources

information alert
Schedule learning time

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Get startedDismiss

Prepare for your certification with this course.

Issued by Amazon Web Services Training and Certification Add to interests

[2025] AWS Certified Solutions Architect Professional Practice Test Questions [SAP-C02] Exam Simulator + Explanations

Rating: 4.2 out of 54.2
1,847 ratings

35,250

Students

210 questions

Total

Last updated May 2025

English

What you'll learn

ASSESS YOUR EXAM READINESS: Pass the AWS Certified Solutions Architect Professional exam the first time with a great score

EXAM SIMULATION: All Practice Tests are timed and scored (passing score is 75%) mimicking the real exam environment

DETAILED EXPLANATIONS: Every question includes a detailed explanation that describes why each answer is correct or incorrect

REFERENCE LINKS: To help you understand the AWS concepts, all answers link to our online Training Notes (Cheat Sheets) with exam-specific information

RANDOMIZED QUESTIONS: Each time you take the test, the questions and answers are randomized to ensure you're learning and not memorizing

MASTER THE CLOUD: Learn how to answer challenging scenario-based questions

PREMIUM-QUALITY: These practice questions are free from typos and technical errors which makes your learning experience much more pleasant

ALWAYS UP TO DATE: Our question bank is constantly updated based on student feedback from the latest SAP-C02 exam. New questions are added on a regular basis

ACTIVE Q&A FORUM: Our discussion board provides a platform for students to ask questions, share their recent exam experiences, and offer feedback on exam topics

RESPONSIVE SUPPORT: Our team of AWS experts respond to all of your questions, concerns or feedback

BEST VALUE FOR MONEY: Our practice exams offer the best value for your money with lifetime access - including all future updates at no extra cost

Show moreShow less

Description

Are you preparing for the AWS Certified Solutions Architect Professional exam and want to ensure you're fully ready to pass your AWS certification exam on your first attempt? Look no further than these high-quality AWS Solutions Architect Professional practice exams to assess your exam-readiness!

These Practice Exams are the best way to prepare for your AWS Certified Solutions Architect Professional exam as they accurately reflect the style and level of difficulty of the real Amazon Web Services exam questions.

This course includes 6 sets of AWS practice tests and each practice test has 30 unique practice questions to optimize your study time. All questions are unique and 100% aligned with the latest AWS SAP-C02 exam blueprint.

SAP-C02 is a challenging exam that includes many long and complex questions that test deep knowledge of many AWS services. We've extracted the core topics from the latest exam blueprint and created this practice exam course that prepares you like no other. This training is your secret weapon to achieving this highly regarded AWS certification.

If you're looking for easy-to-pass questions, our Amazon AWS practice tests may not be for you. Our students love these high-quality practice tests because they simulate the actual certification exam and help them get a better understanding of AWS concepts.

Don't just take our word for it – check out our reviews which confirm that our AWS practice questions closely match the exam pattern and difficulty. These practice tests will prepare you thoroughly for the real exam giving you the confidence you need to take and pass the AWS Certified Solutions Architect Pro exam.

This SAP-C02 practice test course includes:

180 exam-style questions with detailed answers and explanations to reinforce your understanding of the core concepts

Test report that highlights the areas you need to focus on

Regular updates to reflect the latest exam content

Realistic exam simulation to help you build confidence in your ability to pass your exam

Free bonus material to help you succeed in your exam

THESE PRACTICE EXAMS ARE YOUR BEST CHANCE TO ACE YOUR AWS EXAM

100% ALIGNED WITH LATEST SAP-C02 EXAM: Practice Tests are 100% scenario-based reflecting the current AWS exam question/answer format (1 answer from 4 options, or 2 or more answers from 5 or more options)

DEEP DIVE REFERENCE LINKS: Our practice tests offer more than just answers – they link to relevant sections of our online "Training Notes," providing you with a comprehensive collection of exam-specific information for the AWS Solutions Architect Professional exam

DETAILED EXPLANATIONS FOR ALL ANSWERS: Once you complete our practice tests, you'll have the opportunity to review and check your answers. Each question includes a detailed explanation that describes why each answer is either correct or incorrect, supporting your understanding of AWS Services which is key to passing the exam

LIFETIME ACCESS TO ALL FUTURE UPDATES: We're constantly improving and updating the questions based on exam feedback from thousands of our students.

REGULAR UPDATES: We are constantly improving and updating our questions based on exam feedback from thousands of our students. As a result, our students achieve exceptional results, with an average exam score of over 85%.

TEST REPORT: Upon completion of the practice test, you'll receive a comprehensive report that provides insight into your progress and highlights the AWS knowledge areas you need to focus on the most in your studies

ADDITIONAL LEARNING RESOURCES: To help you succeed in your exam, we've included free learning material (optional, requires name/email) that complements the course content

RESPONSIVE SUPPORT: All of your questions, concerns, and feedback will be comprehensively addressed by our team of AWS experts

ACTIVE Q&A DISCUSSION BOARD: Participate in AWS-related discussions on our Q&A discussion board, where our students share their exam experiences and offer valuable feedback on the topics covered

MOBILE ACCESS: Study on the go and access all practice questions from your mobile phone - anywhere, anytime

HOW TO BEST PREPARE FOR YOUR AWS CERTIFICATION EXAM

KEY TRAINING ADVICE: While the actual AWS exam has a passing score of 75%, we recommend that you retake our AWS practice exams until you consistently score 80% or higher. It's important to put in the effort and study the online training notes in detail. Once you achieve the recommended score in our practice tests, you'll be well-prepared to sit the AWS exam and achieve a remarkable score.

GET FAMILIAR WITH EXAM FORMAT: Our AWS Solutions Architect Professional practice exams help you get familiar with the test question format and structure, giving you an edge in the actual AWS exam. While many practice tests in the market do not match the exam pattern format, you can trust that our practice tests will thoroughly prepare you for the real AWS exam.

DEEPEN YOUR KNOWLEDGE: It's important to note that while our AWS practice exams match the style and pattern of the actual exam, they are not brain dumps. Simply memorizing answers will not prepare you for the real AWS certification exam. Instead, we recommend using our AWS Solutions Architect Pro practice exams to deepen your understanding which will give you the best chance of passing your exam no matter what questions you encounter on exam day.

COMPETITIVE ADVANTAGE: These days, most IT roles require AWS training and certification, as Amazon Web Services has become the leading provider of cloud computing services. Our AWS practice tests and supporting training resources are designed to give you a competitive edge and help you pass your AWS Solutions Architect Pro certification exam with confidence.

WHAT DO OTHER STUDENTS SAY?

Our practice tests are widely regarded as the best, providing you with the preparation you need to confidently pass your AWS Certified Solutions Architect Professional exam with a great score. But don't just take our word for it – check out the excellent course reviews from our happy students, who achieved an average passing score of over 850!

"I’ve literally just taken the AWS Solutions Architect Professional examination and I’d just like to say that the questions in this course are the most accurate I’ve ever come across"

"I am elated to share that I have passed my Solution Architect Professional! Thank you for these practice exams!"

"Neal has the BEST practice exams in the industry hands down!"

"Neal's practice tests were extremely useful for me as they were the closest to the real exam."

"Just passed my SA Pro exam. Have to admit that Neal’s Practice Tests are the most relevant to the real exam compared to others practice tests."

YOUR INSTRUCTOR

Hi, I'm Neal Davis, and I'm delighted to be your instructor for this course. As the founder of Digital Cloud Training, I'm deeply committed to providing top-quality AWS certification training resources. I created these practice tests to help you excel in your AWS exam and achieve your professional goals. With over 20 years of hands-on experience in the Cloud space, I'm excited to share my expertise with you on Udemy .

OUR SUCCESS IN NUMBERS

Over 750,000 students enrolled in our AWS courses on Udemy

4.7-star instructor rating from over 150,000 reviews

Our students pass the AWS exam with an average score of over 85%

Watch the intro video to find out why students choose Digital Cloud Training to prepare for their AWS exams.

MONEY-BACK GUARANTEE

We are totally confident in the value of our Practice Exams which come with a 30-day unconditional money-back guarantee. To fast-track your AWS exam success - get lifetime access now - risk-free!

ABOUT THE AWS CERTIFIED SOLUTIONS ARCHITECT PROFESSIONAL CERTIFICATION

The AWS Certified Solutions Architect Professional certification is one of the most sought-after certifications in the cloud computing industry. AWS Solutions Architects are in huge demand and salaries can be above $150,000 USD per annum. The AWS Certified Solutions Architect Professional exam aims to test knowledge of the key services and tools used by Solutions Architects creating applications on AWS.

When you're ready to book your exam, you can do so on the AWS Training portal. Curious about the AWS Solutions Architect Professional certification cost? The SAP-C02 certification cost is $300 USD in most regions and you currently have the choice of an online proctored exam or test center (subject to availability).

OUR MISSION

At Digital Cloud Training we are committed to your success. It is our mission to ensure you pass your exam the first time and don't waste time or money. After going through the entire course and testing your knowledge with the AWS Solutions Architect Professional practice exams, you'll be more than ready for the real AWS exam.

Who this course is for:

Students preparing for the AWS Certified Solutions Architect Professional exam who want to pass with confidence

Candidates preparing for the AWS Certified Solutions Architect Professional exam who want to pass their exam with confidence

Students who want to test their Cloud skills and assess their AWS exam readiness

Students who have completed the AWS Certified Solutions Architect Professional video course from Neal Davis and are looking for some final test prep

Anyone who wants to learn AWS through high-quality questions and answers, explanations and reference links

IT Professionals who want to enter any AWS technical Job interview with confidence

Anyone who is keen to take their career and salary to the next level with an AWS certification

Show moreShow less

Instructors

Neal Davis | AWS Certified Solutions Architect & Developer

AWS Solutions Architect & AWS Certified Instructor

Hi, my name's Neal. I am the founder of Digital Cloud Training, a highly experienced AWS Cloud Solutions Architect and a successful IT instructor. I've been working in IT for over 20 years in a variety of roles ranging from support to architecture. Over the last 15 years, I have mainly worked as a Solutions Architect in the systems integration space designing solutions for enterprise organizations.

My experience in IT has included working with virtualization and cloud computing since it's inception. In my most recent consulting role I worked as an Enterprise Architect designing Hybrid IT and Digital Transformation solutions.

I have always enjoyed earning IT certifications and they have helped me immensely with moving upwards throughout my career. These days, my passion is to help others to achieve their career goals through in-depth AWS certification training resources.

That's why I started digitalcloud.training - to provide certification training resources for Amazon Web Services (AWS) certifications that represent a higher quality standard than is otherwise available in the market.

Connect with me on Facebook, LinkedIn, Youtube or Twitter.

Show moreShow less

Digital Cloud Training | AWS Certified Cloud Practitioner AWS Certified Solutions Architect, AWS Developer Associate

Highest Quality AWS Certification Exam Preparation Resources

Digital Cloud Training provides AWS Certification exam preparation resources including instructor-led Video Courses, guided Hands-on Labs, in-depth Training Notes, Exam-Cram lessons for quick revision, Quizzes to test your knowledge and exam-difficulty Practice Exams to assess your exam readiness.

We strive to provide the highest quality AWS Training Resources that ensure our students are best prepared to pass their AWS exams first time, every time!

With Digital Cloud Training, you get access to highly experienced staff who support you on your AWS Certification journey and help you elevate your career through achieving highly valuable certifications.

Show moreShow less

Requirements

It is recommended that students have successfully passed the AWS Certified Solutions Architect Associate or have equivalent experience

Before assessing your exam readiness, we highly recommend our students to complete the AWS Certified Solutions Architect Professional Video Course by Neal Davis. These instructor-led video lectures from Digital Cloud Training build the solid knowledge foundation preparing students for the final step of their AWS certification journey

Create a new note at 0:00

All lectures

All lectures

Current lecture

Sort by most recent

Sort by most recent

Sort by oldest

Click the "Create a new note" box, the "+" button, or press "B" to make your first note.

Learning reminders

Learning a little each day adds up. Research shows that students who make learning a habit are more likely to reach their goals. Set time aside to learn and get reminders using your learning scheduler.

Học code thui bạn ơi

7:00 PM

Daily

Added to your calendar

Edit

Delete

Download again

Add another

English

Get the app

About us

Help and Support

Terms

Privacy policy

Sitemap

Accessibility statement

© 2025 Udemy, Inc.

Practice Test 6: AWS Certified Solutions Architect Professional

AWS Certified Solutions Architect Professional - Results

Back to result overview
Attempt 3

All domains

All domains

AWS Networking & Content Delivery

AWS Developer Tools

AWS Analytics

AWS Database

AWS Compute

AWS Application Integration

AWS Management & Governance

AWS Security, Identity, & Compliance

AWS Storage

35 all

0 correct

0 incorrect

35 skipped

0 marked

Collapse all questions

Question 1Skipped

A multinational corporation offers a web-based customer relationship management (CRM) tool that operates in the AWS Cloud. The tool is hosted on Amazon EC2 instances situated behind an Application Load Balancer (ALB), with instances spread across multiple Availability Zones within a single AWS Region. As part of its expansion strategy, the corporation plans to deploy the tool in several new AWS Regions.

To comply with customer security policies, the corporation needs to provide fixed IP addresses for the tool so that customers can include these IPs in their firewall allow lists. Additionally, the corporation wants to ensure that users are automatically directed to the nearest regional deployment for optimal performance.

Which solution would fulfill these requirements?

Create an Amazon Route 53 geolocation routing policy. Associate each regional deployment's ALB with Route 53 and provide customers with the IP addresses of the ALBs.

Create an Amazon CloudFront distribution for each regional deployment. Use CloudFront’s edge locations to route traffic and provide customers with the IP address ranges of these edge locations.

Deploy an AWS Transit Gateway with inter-region peering. Link each regional deployment's ALB to the Transit Gateway and share its IP addresses with customers.

Correct answer

Implement AWS Global Accelerator with a standard accelerator configuration. Associate each regional deployment's ALB with the Global Accelerator and distribute its static IP addresses to customers.

Overall explanation

AWS Global Accelerator provides static IP addresses as a core feature, which can be used by customers for their firewall allow lists.

By configuring a standard accelerator and associating it with the ALB of each regional deployment, the solution can route users to the nearest regional instance of the CRM tool.

This setup ensures compliance with customer security policies by providing fixed IP addresses and optimizes user experience by directing traffic based on geographic proximity.

CORRECT: "Implement AWS Global Accelerator with a standard accelerator configuration. Associate each regional deployment's ALB with the Global Accelerator and distribute its static IP addresses to customers" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon Route 53 geolocation routing policy. Associate each regional deployment's ALB with Route 53 and provide customers with the IP addresses of the ALBs" is incorrect.

While Route 53 can route traffic based on geographic location, it does not provide fixed IP addresses for each regional deployment, which is a key requirement for customer firewall configurations.

INCORRECT: "Create an Amazon CloudFront distribution for each regional deployment. Use CloudFront’s edge locations to route traffic and provide customers with the IP address ranges of these edge locations" is incorrect.

CloudFront is primarily a content delivery network and does not provide static IP addresses for its distributions. The IP addresses of CloudFront edge locations are not fixed and thus not suitable for customer allow lists.

INCORRECT: "Deploy an AWS Transit Gateway with inter-region peering. Link each regional deployment's ALB to the Transit Gateway and share its IP addresses with customers" is incorrect.

Transit Gateway facilitates network routing within and across AWS Regions but does not provide the static, publicly accessible IP addresses required for customer firewall configurations. It is more focused on internal network routing rather than external traffic management.

References:

https://docs.aws.amazon.com/global-accelerator/latest/dg/what-is-global-accelerator.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-global-accelerator/

Domain

AWS Networking & Content Delivery

Question 2Skipped

A healthcare company has developed a series of microservices for processing patient data, hosted on AWS. These microservices are accessed through REST APIs managed by Amazon API Gateway. To comply with healthcare regulations, the company needs to ensure that these APIs are only accessible from their internal application, which runs on an Amazon EC2 instance within their AWS VPC. The application must securely access these APIs without exposing them to the public internet.

Which step should a solutions architect take to ensure that the REST APIs are securely accessible by the internal application, while complying with the healthcare regulations?

Configure the API Gateway with a resource policy that restricts access to the IP range of the VPC in which the EC2 instance is running. Ensure the EC2 instance accesses the API Gateway using its public DNS name.

Deploy a reverse proxy server in the VPC and configure it to forward requests to the API Gateway. Restrict access to the proxy server from the EC2 instance only.

Correct answer

Create an interface VPC endpoint for API Gateway in the VPC. Enable private DNS naming for the VPC endpoint and configure an API resource policy that allows access from the VPC endpoint. Use the API endpoint's DNS names to access the API from the EC2 instance.

Set up an Elastic Load Balancer (ELB) in front of the API Gateway and restrict access to the ELB from the EC2 instance's security group.

Overall explanation

Creating an interface VPC endpoint for API Gateway enables the internal application on the EC2 instance to access the REST APIs directly through the AWS private network.

Enabling private DNS naming for the VPC endpoint ensures the internal application can resolve the API Gateway endpoint within the VPC.

The API resource policy that allows access from the VPC endpoint ensures that the APIs are not accessible from the public internet, adhering to the healthcare regulations.

CORRECT: "Create an interface VPC endpoint for API Gateway in the VPC. Enable private DNS naming for the VPC endpoint and configure an API resource policy that allows access from the VPC endpoint. Use the API endpoint's DNS names to access the API from the EC2 instance" is the correct answer (as explained above.)

INCORRECT: "Set up an Elastic Load Balancer (ELB) in front of the API Gateway and restrict access to the ELB from the EC2 instance's security group" is incorrect.

An Elastic Load Balancer is typically used for balancing incoming internet or internal traffic and does not provide the necessary restriction for API Gateway access within a VPC.

INCORRECT: "Configure the API Gateway with a resource policy that restricts access to the IP range of the VPC in which the EC2 instance is running. Ensure the EC2 instance accesses the API Gateway using its public DNS name" is incorrect.

Restricting access based on IP range does not prevent the possibility of exposing the API to the public internet, and using the public DNS name for API access contradicts the requirement for internal-only access.

INCORRECT: "Deploy a reverse proxy server in the VPC and configure it to forward requests to the API Gateway. Restrict access to the proxy server from the EC2 instance only" is incorrect.

Deploying a reverse proxy server adds unnecessary complexity and does not leverage AWS's built-in capabilities for securing API Gateway access within a VPC.

References:

https://docs.aws.amazon.com/vpc/latest/privatelink/interface-endpoints.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-vpc/

Domain

AWS Networking & Content Delivery

Question 3Skipped

An automotive company is using AWS CodeBuild for CI/CD pipelines where each CodeBuild project is directly mapped to an individual application. Many of these applications use large sets of marketing data which is hosted inside an Amazon S3 bucket.

This data is provided by files which are owned by another third-party agency. A few of these projects need the entire set of data while a few of them require just a subset of more relevant data.

As the number of CodeBuild projects grows, the company notices a significant increase in the time required for the pipeline to finish running. The company wants to optimize the pipeline and reduce the amount of time that the pipeline requires to finish running.

Which solution will meet these requirements?

Create a new VPC for the CodeBuild projects. Create an Amazon Elastic File System (Amazon EFS) file system in the VPC. Configure the CodeBuild projects to run in the VPC. Mount the EFS file system at the location of the data file directory.

Configure the cache of the CodeBuild projects as LOCAL_SOURCE_CACHE. Update the build specifications of the CodeBuild projects. Add the data file directory to the cache definition.

Correct answer

Create an S3 bucket for the pipeline. Configure S3 caching for the CodeBuild projects that are in the pipeline. Update the build specifications of the CodeBuild projects. Add the data file directory to the cache definition.

Create an S3 bucket for the pipeline. Configure the S3 bucket as a secondary source location for the CodeBuild projects. Update the build specifications of the CodeBuild projects. Add the S3 bucket and data file directory to the cache definition.

Overall explanation

Local caching stores a cache on a build host. The cache is available to that build host only for a limited time and until another build is complete. For example, when you are dealing with large Java projects, compilation might take a long time. You can speed up subsequent builds by using local caching. This is a good option for large intermediate build artifacts because the cache is immediately available on the build host.

Since files are available in S3, it makes sense to create a pipeline for the bucket and then enable caching to reduce CodeBuild execution time.

CORRECT: "Create an S3 bucket for the pipeline. Configure S3 caching for the CodeBuild projects that are in the pipeline. Update the build specifications of the CodeBuild projects. Add the data file directory to the cache definition" is the correct answer (as explained above.)

INCORRECT: "Create an S3 bucket for the pipeline. Configure the S3 bucket as a secondary source location for the CodeBuild projects. Update the build specifications of the CodeBuild projects. Add the S3 bucket and data file directory to the cache definition" is incorrect.

Since the question mentions that files are in the same location, there is no need to configure a secondary source location, this would have been correct if the source code and other files were at different locations.

INCORRECT: "Configure the cache of the CodeBuild projects as LOCAL_SOURCE_CACHE. Update the build specifications of the CodeBuild projects. Add the data file directory to the cache definition" is incorrect.

As per the definition, LOCAL_SOURCE_CACHE caches Git metadata for primary and secondary sources. After the cache is created, subsequent builds pull only the change between commits. This mode is a good choice for projects with a clean working directory and a source that is a large Git repository. If you choose this option and your project does not use a Git repository (GitHub, GitHub Enterprise, or Bitbucket), the option is ignored hence this is incorrect.

INCORRECT: "Create a new VPC for the CodeBuild projects. Create an Amazon Elastic File System (Amazon EFS) file system in the VPC. Configure the CodeBuild projects to run in the VPC. Mount the EFS file system at the location of the data file directory" is incorrect.

The question doesn’t mention about file sharing across instances and hence this is not a correct use case for ECS.

References:

https://aws.amazon.com/blogs/devops/improve-build-performance-and-save-time-using-local-caching-in-aws-codebuild/

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-developer-tools/

Domain

AWS Developer Tools

Question 4Skipped

An application generates around 15 GB of statistical data each day and this is expected to increase over time. A Solutions Architect plans to store the data in Amazon S3 and use Amazon Athena to analyze the data. The data will be analyzed using date ranges.

Which combination of steps will ensure optimal performance as the data grows? (Select TWO.)

Store the data in Amazon S3 compressed files less than 10 MB in size.

Correct selection

Store the data in Amazon S3 using Apache Parquet or Apache ORC formats.

Correct selection

Store the data using Apache Hive partitioning in Amazon S3 using a key that includes a date.

Store the data in separate buckets for each date range.

Store each object in Amazon S3 with a key that uses a random string.

Overall explanation

There are several recommendations for optimizing the performance of Athena (see link below). These include storing data in a columnar format such as Apache Parquet or Apache ORC and using Apache Hive partitioning in Amazon S3 using a key that includes a date.

CORRECT: "Store the data in Amazon S3 using Apache Parquet or Apache ORC formats" is a correct answer.

CORRECT: "Store the data using Apache Hive partitioning in Amazon S3 using a key that includes a date" is also a correct answer.

INCORRECT: "Store each object in Amazon S3 with a key that uses a random string" is incorrect. This is not a performance recommendation.

INCORRECT: "Store the data in Amazon S3 compressed files less than 10 MB in size" is incorrect. This is not a performance recommendation

INCORRECT: "Store the data in separate buckets for each date range" is incorrect. This is not a performance recommendation.

References:

https://aws.amazon.com/blogs/big-data/top-10-performance-tuning-tips-for-amazon-athena/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-analytics-sap/

Domain

AWS Analytics

Question 5Skipped

A company has recently established 15 Amazon VPCs within the us-east-1 AWS Region. The company has also established an AWS Direct Connect to the Region from their on-premises data center. The company requires full transitive peering between the VPCs and the on-premises data center.

Which combination of actions is required to implement these requirements with the LEAST complexity? (Select TWO.)

Create VPC peering connections between the VPCs in a fully meshed topology. Configure the route tables in the VPCs to route traffic across the peering connections.

Create an AWS Direct Connect (DX) gateway and associate the DX gateway with a VGW in each VPC. Enable route propagation with BGP.

Create IPSec VPN connections between the VPCs in a fully meshed topology. Configure the route tables in the VPCs to route traffic across the IPSec VPN connections.

Correct selection

Create an AWS transit gateway and add attachments for all of the VPCs. Configure the route tables in the VPCs to send traffic to the transit gateway.

Correct selection

Create an AWS Direct Connect (DX) gateway and attach the DX gateway to a transit gateway. Enable route propagation with BGP.

Overall explanation

The simplest solution here with the lowest complexity is to use a combination of an AWS transit gateway and a DX gateway. The transit gateway allows fully transitive connections between VPCs in a Region. The DX gateway can then connect the transit gateway to the DX connection. BGP is used to propagate routes from the on-premises data center into AWS and vice versa.

The diagram below depicts a similar configuration with transit gateway and DX gateway:

CORRECT: "Create an AWS transit gateway and add attachments for all of the VPCs. Configure the route tables in the VPCs to send traffic to the transit gateway" is a correct answer.

CORRECT: "Create an AWS Direct Connect (DX) gateway and attach the DX gateway to a transit gateway. Enable route propagation with BGP" is also a correct answer.

INCORRECT: "Create VPC peering connections between the VPCs in a fully meshed topology. Configure the route tables in the VPCs to route traffic across the peering connections" is incorrect. This would be highly complex with many connections between VPCs and complex routing configurations. Transit gateway greatly simplifies this solution.

INCORRECT: "Create an AWS Direct Connect (DX) gateway and associate the DX gateway with a VGW in each VPC. Enable route propagation with BGP" is incorrect. DX gateway is good for cross-Region and cross-Account scenarios. In this scenario with many VPCs in a Region it is better to use a transit gateway.

INCORRECT: "Create IPSec VPN connections between the VPCs in a fully meshed topology. Configure the route tables in the VPCs to route traffic across the IPSec VPN connections" is incorrect. This is another example of a much more complex solution to the requirements.

References:

https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Question 6Skipped

A company is migrating an application into AWS. The application code has already been installed and tested on Amazon EC2. The database layer consists of a 25 TB MySQL database in the on-premises data center. There is a 50 Mbps internet connection and an IPSec VPN connection to the Amazon VPC. The company plans to go live on AWS within 2 weeks.

Which combination of actions will meets the migration schedule with the LEAST downtime? (Select THREE.)

Launch an AWS DMS instance and configure it with the on-premises and Aurora DB instance information. Replicate using AWS DMS over the VPN connection.

Launch an Amazon RDS Aurora MySQL DB instance and use AWS DMS to migrate the on-premises database.

Correct selection

Export the data from the database using database-native tools and import the data to AWS using AWS Snowball.

Correct selection

When the RDS Aurora MySQL database is fully synchronized, change the DNS entry to point to the Aurora DB instance and stop replication.

Correct selection

Launch an RDS Aurora MySQL DB instance and load the database data from the Snowball export. Configure replication from the on-premises database to the RDS Aurora instance using the VPN.

Use AWS SMS to import the on-premises database into AWS and then use AWS DMS to synchronize the database with an Amazon Aurora MySQL DB instance.

Overall explanation

The internet connection is too slow to migrate this database within the 2 week timeframe. Therefore, another method must be used that migrates it within the timeframe whilst avoiding downtime as much as possible.

The best approach to this situation is to use a database export and migrate the exported data to AWS using AWS Snowball. Once migrated into the AWS Cloud, the data can be loaded into a newly launched Amazon Aurora MySQL DB instance. Native SQL replication can then be used to synchronize the databases with any changes.

Once the Aurora DB instance is in sync with the on-premises DB instance the DNS entry can be changed to point to the Aurora DB instance and the application will start to use the Aurora DB instance.

CORRECT: "Export the data from the database using database-native tools and import the data to AWS using AWS Snowball" is a correct answer.

CORRECT: "Launch an RDS Aurora MySQL DB instance and load the database data from the Snowball export. Configure replication from the on-premises database to the RDS Aurora instance using the VPN" is also a correct answer.

CORRECT: "When the RDS Aurora MySQL database is fully synchronized, change the DNS entry to point to the Aurora DB instance and stop replication" is also a correct answer.

INCORRECT: "Launch an AWS DMS instance and configure it with the on-premises and Aurora DB instance information. Replicate using AWS DMS over the VPN connection" is incorrect. It would take far too long to migrate the entire 25 TB database over a 50 Mbps internet connection.

INCORRECT: "Launch an Amazon RDS Aurora MySQL DB instance and use AWS DMS to migrate the on-premises database" is incorrect. This is similar to the above answer but may be used on combination with the answer below. Neither of these approaches is acceptable in this scenario.

INCORRECT: "Use AWS SMS to import the on-premises database into AWS and then use AWS DMS to synchronize the database with an Amazon Aurora MySQL DB instance" is incorrect. AWS SMS is used to migrate servers into AWS, this would use the internet connection and would take too long.

References:

https://aws.amazon.com/snowball/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-migration-sap/

Domain

AWS Database

Question 7Skipped

A company is planning to launch a new web application on AWS using a fully serverless design. The website will be used by global customers and should be highly responsive and offer minimal latency. The design should be highly availably and include baseline DDoS protections against spikes in traffic. The users will login in to the web application using social IdPs such as Google, and Amazon.
How can the design requirements be met?

Build an API using Docker containers running on AWS Fargate in multiple Regions behind Application Load Balancers. Use an Amazon Route 53 latency-based routing policy. Use Amazon Cognito to provide user management authentication functions.

Correct answer

Build an API with API Gateway and AWS Lambda, use Amazon S3 for hosting static web resources and create an Amazon CloudFront distribution with the S3 bucket as the origin. Use Amazon Cognito to provide user management authentication functions.

Build an API with API Gateway and AWS Lambda, use Amazon S3 for hosting static web resources and create an AWS WAF Web ACL and attach it for DDoS attack mitigation. Use Amazon Cognito to provide user management authentication functions.

Build an API using Docker containers running on Amazon ECS behind an Amazon CloudFront distribution. Use AWS Secrets Manager to provide user management authentication functions.

Overall explanation

A serverless web application can be created using a REST API running on API Gateway, a Lambda function, and S3 to store static assets. CloudFront can then be used to cache the S3 assets for lower latency for the global user base. CloudFront also offers basic DDoS protections with AWS Shield standard offered for free for use with CloudFront. Amazon Cognito is ideal for implementing user authentication for this type of application and you can integrate with social IdPs.

CORRECT: "Build an API with API Gateway and AWS Lambda, use Amazon S3 for hosting static web resources and create an Amazon CloudFront distribution with the S3 bucket as the origin. Use Amazon Cognito to provide user management authentication functions" is the correct answer.

INCORRECT: "Build an API using Docker containers running on Amazon ECS behind an Amazon CloudFront distribution. Use AWS Secrets Manager to provide user management authentication functions" is incorrect. You cannot put CloudFront directly in front of ECS, you must point it to a load balancer. Secrets Manager is not an authentication service, it is used for securely storing secrets such as passwords.

INCORRECT: "Build an API using Docker containers running on AWS Fargate in multiple Regions behind Application Load Balancers. Use an Amazon Route 53 latency-based routing policy. Use Amazon Cognito to provide user management authentication functions" is incorrect. This is a serverless design but it is not the best design. Using Lambda functions and API gateway will likely be more cost-effective and scale more seamlessly. Also CloudFront is a better way to get assets such as media files closer to users and cheaper than hosting the solution in many Regions.

INCORRECT: "Build an API with API Gateway and AWS Lambda, use Amazon S3 for hosting static web resources and create an AWS WAF Web ACL and attach it for DDoS attack mitigation. Use Amazon Cognito to provide user management authentication functions" is incorrect. A WAF Web ACL will not provide DDoS attack mitigation, use AWS Shield instead or use CloudFront with WAF.

References:

https://aws.amazon.com/shield/

https://aws.amazon.com/serverless/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-compute-sap/

Domain

AWS Networking & Content Delivery

Question 8Skipped

A company has connected their on-premises data center to AWS using a single AWS Direct Connect (DX) connection using a private virtual interface. The company is hosting the front end for a business-critical application in an Amazon VPC. The back end is hosted on-premises and the company requires consistent, reliable, and redundant connectivity between the front end and back end of the application.

Which design would provide the MOST resilient connectivity between AWS and the on-premises data center?

Create an AWS Managed VPN connection that uses the public internet and attach it to the same virtual private gateway as the DX connection.

Add an additional physical connection for the existing DX connection using the same network carrier and join the connections to a link aggregation group (LAG) on the same private virtual interface.

Use multiple IPSec VPN connections to separate virtual private gateways and configure BGP to prioritize the DX connection.

Correct answer

Install a second DX connection from a different network carrier and attach it to the same virtual private gateway as the first DX connection.

Overall explanation

Another DX connection should be established from a different carrier. This will provide physical separation and redundancy for the DX connections and is preferable to using the same carrier which could result in sharing the same physical pathways. The virtual private gateway has built in redundancy so sharing a VGW is acceptable.

CORRECT: "Install a second DX connection from a different network carrier and attach it to the same virtual private gateway as the first DX connection" is the correct answer.

The diagram below depicts the most highly available and redundant configuration for Direct Connect with multiple DX locations, physical connections and data centers. Note the single points of failure that must be eliminated for maximum redundancy.

INCORRECT: "Use multiple IPSec VPN connections to separate virtual private gateways and configure BGP to prioritize the DX connection" is incorrect. Separate DX links a preferable to using the internet for better reliability as the internet can be subject to various bandwidth and latency constraints.

INCORRECT: "Add an additional physical connection for the existing DX connection using the same network carrier and join the connections to a link aggregation group (LAG) on the same private virtual interface" is incorrect. This does not provide as much redundancy as the same network carrier is used which means the physical pathways may be the same.

INCORRECT: "Create an AWS Managed VPN connection that uses the public internet and attach it to the same virtual private gateway as the DX connection" is incorrect. Using the internet does not provide the reliability that the solution requires and cost is not mentioned so another DX connection is preferable.

References:

https://aws.amazon.com/directconnect/resiliency-recommendation/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Question 9Skipped

A business is in the process of setting up an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to manage a specific workload. This workload is expected to generate a highly variable number of stateless pods, with a significant number of these pods being launched in a brief timeframe due to automatic scaling of replicas.

What approach should be taken to optimize the resilience of the nodes in this scenario?

Correct answer

Adjust the workload configuration to utilize topology spread constraints based on different Availability Zones.

Modify the node groups for the workload by reducing the number of node groups but opting for larger instances within these groups.

Implement a distinct launch template for deploying the EKS control plane in a secondary cluster, separate from the node groups that handle the workload.

Set up the Kubernetes Cluster Autoscaler to maintain the compute capacity of the workload node groups at a consistently under provisioned level.

Overall explanation

Using topology spread constraints based on Availability Zones is a strategic approach to enhance node resilience in an Amazon EKS cluster.

This method ensures that the pods are evenly distributed across different Availability Zones.

By doing so, it reduces the risk of a significant impact on the workload if one Availability Zone experiences issues, thereby maximizing node resilience and ensuring better fault tolerance and high availability.

CORRECT: "Adjust the workload configuration to utilize topology spread constraints based on different Availability Zones" is the correct answer (as explained above.)

INCORRECT: "Implement a distinct launch template for deploying the EKS control plane in a secondary cluster, separate from the node groups that handle the workload" is incorrect.

Deploying a separate EKS control plane in a different cluster does not directly contribute to the resilience of the nodes within the workload node groups. The control plane's location and configuration are more about management and orchestration rather than node resilience.

INCORRECT: "Modify the node groups for the workload by reducing the number of node groups but opting for larger instances within these groups" is incorrect.

Using fewer node groups with larger instances might improve performance but does not necessarily maximize node resilience. Larger instances can still be susceptible to zone-specific issues, and having fewer groups could reduce the distribution and fault tolerance capabilities.

INCORRECT: "Set up the Kubernetes Cluster Autoscaler to maintain the compute capacity of the workload node groups at a consistently under provisioned level" is incorrect.

Keeping the compute capacity of the workload node groups under provisioned is counterproductive for maximizing node resilience. Under provisioning can lead to insufficient resources during peak demand, potentially causing performance issues or even service disruptions.

References:

https://aws.github.io/aws-eks-best-practices/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Compute

Question 10Skipped

A company is in the planning stages for an application projected to hold around 15 TB of data. They require a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 15 minutes. The team is seeking a database solution that not only meets these recovery objectives but also allows for cost-effective failover to a backup AWS Region.

Which database solution aligns best with these requirements while minimizing costs?

Correct answer

Configure an Amazon RDS instance with a cross-Region read replica in an alternative Region. Should the primary Region fail, promote the read replica to become the new primary database.

Configure an Amazon RDS instance with a read replica within the same Region. In the event of a failure, promote the read replica to serve as the primary database.

Create an Amazon Aurora DB cluster in the main Region and a separate Aurora cluster in a secondary Region. Utilize AWS Database Migration Service (DMS) to continuously replicate data between the two clusters.

Deploy an Amazon Aurora DB cluster, schedule snapshots every 5 minutes, and regularly copy these snapshots to a backup Region. In case of a primary Region failure, use these snapshots to restore the database in the secondary Region.

Overall explanation

Using Amazon RDS with a cross-Region read replica is a cost-effective solution that meets the specified RPO and RTO. The read replica in the secondary Region ensures that the data is continuously replicated, meeting the 5-minute RPO.

In the event of a primary Region failure, the read replica can be quickly promoted to a primary instance, aligning with the 15-minute RTO. This approach provides a balance between cost, data availability, and recovery speed, making it suitable for the company's requirements.

CORRECT: "Configure an Amazon RDS instance with a cross-Region read replica in an alternative Region. Should the primary Region fail, promote the read replica to become the new primary database" is the correct answer (as explained above.)

INCORRECT: "Deploy an Amazon Aurora DB cluster, schedule snapshots every 5 minutes, and regularly copy these snapshots to a backup Region. In case of a primary Region failure, use these snapshots to restore the database in the secondary Region" is incorrect.

While Aurora is a powerful database solution, taking and copying snapshots every 5 minutes could be resource-intensive and may not provide the most cost-effective solution.

INCORRECT: "Create an Amazon Aurora DB cluster in the main Region and a separate Aurora cluster in a secondary Region. Utilize AWS Database Migration Service (DMS) to continuously replicate data between the two clusters" is incorrect.

Using AWS DMS for continuous replication between two Aurora clusters in different Regions can be more expensive and complex than necessary, especially for maintaining a 5-minute RPO.

INCORRECT: "Configure an Amazon RDS instance with a read replica within the same Region. In the event of a failure, promote the read replica to serve as the primary database" is incorrect.

This setup does not provide failover to a secondary Region, which is a key requirement in the scenario. It's more suited for high availability within the same Region rather than for cross-Region disaster recovery.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html#USER_ReadRepl.XRgn

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-rds/

Domain

AWS Database

Question 11Skipped

A legacy application consists of a series of batch scripts that coordinate multiple application components. Each application component processes data within a few seconds before passing it on to the next component. The application has become complex and difficult to update. A Solutions Architect plans to migrate the application to the AWS Cloud. The application should be refactored into serverless microservices and be fully coordinated using cloud-native services.

Which approach meets these requirements most cost-effectively?

Refactor the application onto Docker containers running on Amazon ECS. Use Amazon SQS to decouple the application components.

Correct answer

Refactor the application onto AWS Lambda functions. Use AWS Step Functions to orchestrate the application.

Refactor the application onto AWS Lambda functions. Use Amazon EventBridge to automate the application.

Refactor the application onto Docker containers running on AWS Fargate. Use AWS Step Functions to orchestrate the application.

Overall explanation

The application components process data within a few seconds, and therefore can easily be migrated to AWS Lambda without hitting the maximum execution time (i.e. 900 seconds). The various Lambda functions can then be orchestrated using AWS Step Functions. This is the most cost-effective solution that meets the requirements.

CORRECT: "Refactor the application onto AWS Lambda functions. Use AWS Step Functions to orchestrate the application" is the correct answer.

INCORRECT: "Refactor the application onto Docker containers running on AWS Fargate. Use AWS Step Functions to orchestrate the application" is incorrect. AWS Fargate is a serverless service but it is likely to be more expensive in comparison to AWS Lambda.

INCORRECT: "Refactor the application onto Docker containers running on Amazon ECS. Use Amazon SQS to decouple the application components" is incorrect. Amazon ECS (EC2 launch type) is not serverless. SQS is not needed here as there is no mention of decoupling, only orchestration.

INCORRECT: "Refactor the application onto AWS Lambda functions. Use Amazon EventBridge to automate the application" is incorrect. EventBridge (CloudWatch Events) is used to respond to state changes in AWS infrastructure. It is not used for coordinating components of an application.

References:

https://aws.amazon.com/step-functions/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-application-integration-sap/

Domain

AWS Application Integration

Question 12Skipped

A company has created a management account and added several member accounts in an AWS Organization. The security team wishes to restrict access to a specific set of AWS services in the existing member accounts.

How can this requirement be implemented MOST efficiently?

Correct answer

Add the member accounts to a single organizational unit (OU). Create a service control policy (SCP) that denies access to the specific set of services and attach it to the OU.

Create an IAM role in each member account and attach a policy to the role the denies access to the specific set of services. Create user accounts in the management account and instruct users to assume the IAM role in each member account to gain access to services.

Create an IAM policy in each account that denies access to the services. Associate the policy with an IAM group and add all IAM users to the group.

Create a service control policy (SCP) that denies access to the specific set of services and apply the policy to the root of the organization.

Overall explanation

The best solution is to use an SCP to control access to the AWS services and apply that SCP to an OU that contains the member accounts. The SCP limits the maximum available permissions for the entire account and means users in that account will not be able to access the restricted services even if they have permissions to do so.

The diagram below depicts how SCPs can be used to control access to services:

CORRECT: "Add the member accounts to a single organizational unit (OU). Create a service control policy (SCP) that denies access to the specific set of services and attach it to the OU" is the correct answer.

INCORRECT: "Create an IAM policy in each account that denies access to the services. Associate the policy with an IAM group and add all IAM users to the group" is incorrect. As the requirement is to restrict access for everyone in the account it is more efficient to use SCPs which will also ensure mistakes cannot be made when assigning permissions (the SCP will always deny).

INCORRECT: "Create an IAM role in each member account and attach a policy to the role the denies access to the specific set of services. Create user accounts in the management account and instruct users to assume the IAM role in each member account to gain access to services" is incorrect. This is more complex configuration and it is not best practice to create the user accounts in the management account as you cannot apply SCPs to the management account.

INCORRECT: "Create a service control policy (SCP) that denies access to the specific set of services and apply the policy to the root of the organization" is incorrect. This would apply the SCP to the existing member accounts and any new accounts that are added which may not be desired.

References:

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_inheritance_auth.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Management & Governance

Question 13Skipped

A company is reviewing its CI/CD practices for updating a critical web application that runs on Amazon ECS. The application manager requires that deployments happen as quickly as possible with a minimum of downtime. In the case of errors there must be an ability to quickly roll back. The company currently uses AWS CodeCommit to host the application source code and has configured an AWS CodeBuild project to build the application. The company also plans to use AWS CodePipeline to trigger builds from CodeCommit commits using the existing CodeBuild project.

What changes should be made to the CI/CD configuration to meet these requirements?

Create a pipeline in CodePipeline with a deploy stage that uses AWS OpsWorks and in-place deployments. Monitor the application and if there are any issues push another code update.

Correct answer

Create a pipeline in CodePipeline with a deploy stage that uses a blue/green deployment strategy. Monitor the application and if there are any issues trigger a manual rollback using CodeDeploy.

Create a pipeline in CodePipeline with a deploy stage that uses AWS CloudFormation to create test and production stacks. Monitor the application and if there are any issues push another code update.

Create a pipeline in CodePipeline with a deploy stage that uses an in-place deployment strategy. Monitor the application and if there are any issues push another code update.

Overall explanation

The best option for deploying the updates quickly is to create a pipeline in CodePipeline with the source set to CodeCommit, the build set to the CodeBuild project, and the deploy stage configured to use CodeDeploy to push the updates to the application. A blue/green deployment strategy ensures that rollback can be easily and quickly performed should there be any issues found with the code.

The architecture described in this solution looks like the following diagram:

CORRECT: "Create a pipeline in CodePipeline with a deploy stage that uses a blue/green deployment strategy. Monitor the application and if there are any issues trigger a manual rollback using CodeDeploy" is the correct answer.

INCORRECT: "Create a pipeline in CodePipeline with a deploy stage that uses AWS CloudFormation to create test and production stacks. Monitor the application and if there are any issues push another code update" is incorrect. CodeDeploy should be used with a blue/green deployment strategy. This is simpler and provides a seamless capability to cut over to the new code in a staged manner and cut back should issues occur.

INCORRECT: "Create a pipeline in CodePipeline with a deploy stage that uses an in-place deployment strategy. Monitor the application and if there are any issues push another code update" is incorrect. With an in-place deployment strategy all application instances are updated at the same time, this could cause more usability issues if there are any problems with the code and is more time consuming and disruptive to roll back from.

INCORRECT: "Create a pipeline in CodePipeline with a deploy stage that uses AWS OpsWorks and in-place deployments. Monitor the application and if there are any issues push another code update" is incorrect. CodeDeploy should be used rather than OpsWorks, and a blue/green deployment strategy instead of in-place.

References:

https://aws.amazon.com/blogs/devops/use-aws-codedeploy-to-implement-blue-green-deployments-for-aws-fargate-and-amazon-ecs/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-developer-tools-sap/

Domain

AWS Developer Tools

Question 14Skipped

An application runs in us-east-1 and consists of Amazon EC2 instances behind an Application Load Balancer (ALB) and an Amazon RDS MySQL database. The company is creating a disaster recovery solution to a second AWS Region (us-west-1). A solution has been created for replicating AMIs across Regions and an ALB is provisioned in us-west-1. Amazon Route 53 failover routing is configured appropriately. A Solutions Architect must complete the solution by designing the disaster recovery processes for the storage layer. The RPO is 5 minutes and the RTO is 15 minutes. The solution must be fully automated.

Which set of actions would complete the disaster recovery solution?

Create a cron job that runs the mysqldump command to export the MySQL database to a file stored on Amazon S3. Use Amazon EventBridge to trigger an AWS Lambda function that imports the database export to a standby database in us-west-1.

Deploy an Amazon RDS Multimaster database across both AWS Regions. Configure the EC2 instances in us-west-1 to write to the local RDS writer endpoint.

Correct answer

Create a cross-Region read replica in us-west-1. Use Amazon EventBridge to trigger an AWS Lambda function that promotes the read replica to primary and updates the DNS endpoint address for the database.

Use an AWS Lambda function to replicate Amazon RDS snapshots to us-west-1. Use an Amazon EventBridge to trigger an AWS Lambda function that creates a new RDS database from the replicated snapshot.

Overall explanation

A cross-Region read replica will ensure that the database in us-west-1 is synchronized within the RPO (5 minutes). Read replicas can be promoted to primary at any time and this creates a new writable database.

The promotion process takes a few minutes to complete. When you promote a read replica, replication is stopped and the read replica is rebooted. When the reboot is complete, the read replica is available as a new DB instance.

At this point the DNS endpoint must be updated so applications can connect to the new writable database. This entire process can be automated using CloudWatch alarms and EventBridge triggers to AWS Lambda.

CORRECT: "Create a cross-Region read replica in us-west-1. Use Amazon EventBridge to trigger an AWS Lambda function that promotes the read replica to primary and updates the DNS endpoint address for the database" is the correct answer.

INCORRECT: "Use an AWS Lambda function to replicate Amazon RDS snapshots to us-west-1. Use an Amazon EventBridge to trigger an AWS Lambda function that creates a new RDS database from the replicated snapshot" is incorrect. The RPO is 5 minutes so it would be likely that the snapshots would not be up to date enough to meet this requirement. It is also likely that the RTO will be exceeded as creating a new DB from a snapshot will take much longer than promoting a replicated DB instance.

INCORRECT: "Deploy an Amazon RDS Multimaster database across both AWS Regions. Configure the EC2 instances in us-west-1 to write to the local RDS writer endpoint" is incorrect. Multimaster is a concept that relates to Amazon Aurora databases and within a Region only.

INCORRECT: "Create a cron job that runs the mysqldump command to export the MySQL database to a file stored on Amazon S3. Use Amazon EventBridge to trigger an AWS Lambda function that imports the database export to a standby database in us-west-1" is incorrect. This option is also likely to fail both the RPO and the RTO and is more complex and less secure.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_ReadRepl.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

Domain

AWS Database

Question 15Skipped

A business is transitioning its website from an on-premises setup to AWS, aiming to adopt a containerized microservice architecture for enhanced availability and cost efficiency. In line with the company's stringent security policies, which emphasize minimal privilege for network permissions and privileges, a solutions architect has already deployed the application on an Amazon ECS cluster.

To align with these security requirements post-deployment, what two actions should be taken? (Select TWO.)

Assign security groups directly to the tasks and inject IAM credentials into the containers at startup for resource access.

Correct selection

Attach security groups to the individual tasks and utilize IAM roles specifically designed for tasks to access other AWS resources.

Correct selection

Set up the tasks using the awsvpc network mode for enhanced network isolation and control.

Configure the tasks to operate in the bridge network mode within the ECS environment.

Implement security groups at the EC2 instance level and assign IAM roles to these instances for accessing other AWS resources.

Overall explanation

The awsvpc network mode provides each task with its own elastic network interface, IP address, and security group, offering better isolation and control compared to bridge mode. This aligns with best practices for security and network configuration in a microservices architecture.

Applying security groups to tasks and using IAM roles for tasks is a best practice in AWS. This approach ensures that each task has the minimum necessary permissions to access other AWS resources, adhering to the principle of least privilege.

CORRECT: "Set up the tasks using the awsvpc network mode for enhanced network isolation and control" is a correct answer (as explained above.)

CORRECT: "Attach security groups to the individual tasks and utilize IAM roles specifically designed for tasks to access other AWS resources" is also a correct answer (as explained above.)

INCORRECT: "Configure the tasks to operate in the bridge network mode within the ECS environment" is incorrect.

The bridge network mode does not provide the same level of network isolation and control as the awsvpc network mode, making it less suitable for strict security requirements.

INCORRECT: "Implement security groups at the EC2 instance level and assign IAM roles to these instances for accessing other AWS resources" is incorrect.

While applying security groups to EC2 instances is a common practice, it does not provide the granular control at the task level that is often required in a microservices architecture.

INCORRECT: "Assign security groups directly to the tasks and inject IAM credentials into the containers at startup for resource access" is incorrect.

Passing IAM credentials into containers is not a recommended practice due to security risks. It's better to use IAM roles for tasks, which provide temporary credentials and are more secure.

References:

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking.html

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ecs-and-eks/

Domain

AWS Security, Identity, & Compliance

Question 16Skipped

A company uses AWS CodeCommit for source control and AWS CodePipeline for continuous integration. The pipeline has a build stage which uses an Amazon S3 bucket for artifacts. The company requires a new development pipeline for testing new features. The new pipeline should be isolated from the production pipeline and incorporate continuous testing for unit tests.

How can a Solutions Architect meet these requirements?

Create a separate pipeline in CodePipeline and trigger execution using CodeCommit branches. Use AWS Lambda for running unit tests. Use AWS CodeDeploy to stage the artifacts within an S3 bucket in a separate testing account.

Correct answer

Create a separate pipeline in CodePipeline and trigger execution using CodeCommit branches. Use AWS CodeBuild for running unit tests and stage the artifacts in an S3 bucket in a separate testing account.

Create a separate CodeCommit repository for feature development and use it to trigger the pipeline. Use AWS Lambda for running unit tests. Use AWS CodeBuild to stage the artifacts within different S3 buckets in the same production account.

Create a separate pipeline in CodePipeline and trigger execution using CodeCommit tags. Use Jenkins for running unit tests. Create a stage in the pipeline with S3 as the target for staging the artifacts with an S3 bucket in a separate testing account.

Overall explanation

Branches are pointers or references to a commit. In development, they're a convenient way to organize your work. You can use branches to separate work on a new or different version of files without affecting work in other branches. In this case a branch can trigger a separate pipeline and CodeBuild can be used for running unit tests in that pipeline. The artifacts can be stored in a separate account for isolation from the production environment.

CORRECT: "Create a separate pipeline in CodePipeline and trigger execution using CodeCommit branches. Use AWS CodeBuild for running unit tests and stage the artifacts in an S3 bucket in a separate testing account" is the correct answer.

INCORRECT: "Create a separate pipeline in CodePipeline and trigger execution using CodeCommit branches. Use AWS Lambda for running unit tests. Use AWS CodeDeploy to stage the artifacts within an S3 bucket in a separate testing account" is incorrect. CodeBuild should be used for running the units tests instead of Lambda.

INCORRECT: "Create a separate pipeline in CodePipeline and trigger execution using CodeCommit tags. Use Jenkins for running unit tests. Create a stage in the pipeline with S3 as the target for staging the artifacts with an S3 bucket in a separate testing account" is incorrect. CodeCommit branches rather than tags should be used to trigger the pipeline and CodeBuild should be used for running the units tests instead of Jenkins.

INCORRECT: "Create a separate CodeCommit repository for feature development and use it to trigger the pipeline. Use AWS Lambda for running unit tests. Use AWS CodeBuild to stage the artifacts within different S3 buckets in the same production account" is incorrect. Branches can be used instead of a separate CodeCommit repository, CodeBuild should run unit tests and a separate account should be used for storing artifacts.

References:

https://docs.aws.amazon.com/codecommit/latest/userguide/branches.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-developer-tools-sap/

Domain

AWS Developer Tools

Question 17Skipped

A company is creating an account structure on AWS. There will be separate accounts for the production and testing environments. The Solutions Architect wishes to implement centralized control of security identities and permissions to access the environments.

Which solution is most appropriate for these requirements?

Create a separate AWS account for identities where IAM user accounts can be created. Create roles with appropriate permissions in the identity account and delegate access to the production and testing accounts.

Create all user accounts in the production account. Create roles for access in the production account and testing accounts. Grant cross-account access from the production account to the testing account.

Correct answer

Create a separate AWS account for identities where IAM user accounts can be created. Create roles with appropriate permissions in the production and testing accounts. Add the identity account to the trust policies for the roles.

Create an AWS Organization that includes the production and testing accounts. Create IAM user accounts in the production and testing accounts and implement service control policies (SCPs) to centrally control permissions.

Overall explanation

The AWS best practice for this situation is to use an identity account to store all user and service accounts. You then create roles in the accounts you want to access and delegate permissions for the identity account users (or the whole account) to be able to assume the role. This provides centralized control of security identities.

The configuration for cross-account access between two accounts is depicted below. In this diagram the user in account B (the identity account) is able to assume a role in account A (the resource account) and access an S3 bucket.

CORRECT: "Create a separate AWS account for identities where IAM user accounts can be created. Create roles with appropriate permissions in the production and testing accounts. Add the identity account to the trust policies for the roles" is the correct answer.

INCORRECT: "Create an AWS Organization that includes the production and testing accounts. Create IAM user accounts in the production and testing accounts and implement service control policies (SCPs) to centrally control permissions" is incorrect. The identities should be created in a separate identity account as Organizations does not provide centralized control of identities as they are always created within individual accounts. SCPs control the maximum available permissions but to not actually control the IAM permissions assigned to users.

INCORRECT: "Create a separate AWS account for identities where IAM user accounts can be created. Create roles with appropriate permissions in the identity account and delegate access to the production and testing accounts" is incorrect. The roles should be created in the production and testing accounts, not in the identity account.

INCORRECT: "Create all user accounts in the production account. Create roles for access in the production account and testing accounts. Grant cross-account access from the production account to the testing account" is incorrect. A separate account should be created for identities.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Security, Identity, & Compliance

Question 18Skipped

A company is planning a move to the AWS Cloud and is creating an account strategy. There are various teams in the company and each team prefers to keep their resources isolated from other teams. The Finance team would like each team’s resource usage separated for billing purposes. The Security team will provide permissions to each team using the principle of least privilege.

Which account strategy will meet all of these requirements?

Create a new AWS account and use AWS CloudFormation to provides teams with the resources they require. Use cost allocation tags and a third-party billing solution to provide the Finance team with a breakdown of costs based on tags. Use IAM policies to control access to resources and grant the Security team full access.

Use AWS Organizations to create a management account. Create groups in Active Directory and assign them to roles in AWS to grant federated access. Apply tags to the resources for each team and separate bills based on tags. Control access to resources through IAM granting the minimum required privileges.

Create a separate AWS account for each team. Assign the security account as the management account and enable consolidated billing for all other accounts. Create a cross-account role for security to manage accounts.

Correct answer

Use AWS Organizations to create a management account and create each team’s account from the management account. Create a security account for cross-account access. Apply service control policies on each account and grant the security team cross-account access to all accounts. The Security team will create IAM policies to provide least privilege access.

Overall explanation

With AWS Organizations you must first create an organization which creates the management account. It is a best practice not to use the management account for anything except creating policies and other accounts in the organization as you cannot apply SCPs to the management account.

The company should then create separate accounts for each within the organization using AWS Organization. Consolidated billing will then provide a separate bill to the Finance team for each team (account).

A security account can be created for the Security team and this will be where security team members have their IAM user accounts. They can use this account with cross-account access to other accounts to manage those accounts by applying SCPs and IAM policies.

The slide below provides an overview of AWS Organizations and a multi-account structure:

CORRECT: "Use AWS Organizations to create a management account and create each team’s account from the management account. Create a security account for cross-account access. Apply service control policies on each account and grant the security team cross-account access to all accounts. The Security team will create IAM policies to provide least privilege access." is the correct answer.

INCORRECT: "Use AWS Organizations to create a management account. Create groups in Active Directory and assign them to roles in AWS to grant federated access. Apply tags to the resources for each team and separate bills based on tags. Control access to resources through IAM granting the minimum required privileges" is incorrect. There is no requirement for federation with Active Directory in this scenario so this is not a good answer.

INCORRECT: "Create a separate AWS account for each team. Assign the security account as the management account and enable consolidated billing for all other accounts. Create a cross-account role for security to manage accounts" is incorrect. With Organizations you create the accounts from the management account or link them to the management account through an invitation to the organization. Consolidated billing is then enabled for ALL accounts. The security account should not be the management account as you cannot apply SCPs to the management account so it should not be used for creating user accounts.

INCORRECT: "Create a new AWS account and use AWS CloudFormation to provides teams with the resources they require. Use cost allocation tags and a third-party billing solution to provide the Finance team with a breakdown of costs based on tags. Use IAM policies to control access to resources and grant the Security team full access" is incorrect. Separate accounts in an organization are better for the billing purposes and avoid the requirement to use third-party software.

References:

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Management & Governance

Question 19Skipped

The security department of a large company with several AWS accounts wishes to centralize the management of identities and AWS permissions. The design should also synchronize authentication credentials with the company’s existing on-premises identity management provider (IdP).

Which solution will meet the security department’s requirements?

Create an AWS Organization with a management account that defines the SCPs for member accounts. Create a SAML-based identity management provider in each account and map users in the on-premises IdP groups to IAM roles.

Create a SAML-based identity management provider in a central account and map IAM roles that provide the necessary permissions for users. Create a centralized AWS Lambda function that replicates the identities in the on-premises IdP groups to the AWS accounts.

Deploy the required IAM users, groups, roles, and policies in every AWS account. Create an AWS Organization and federate the on-premises identity management provider and the AWS accounts.

Correct answer

Create a SAML-based identity management provider in a central account and map IAM roles that provide the necessary permissions for users. Map users in the on-premises IdP groups to IAM roles. Use cross-account access to the other AWS accounts.

Overall explanation

A SAML-based IdP can be created that integrates with AWS IAM. In this configuration you map IAM roles that are assumed by authenticated identities. These IAM roles must have the correct permissions for users. The users can then assume roles in the other AWS accounts in order to perform there.

This solution centralizes the management of identities, federation, and permissions and allows the users to access each account as needed. The diagram below depicts how identity federation works between IAM and an on-premises IdP:

CORRECT: "Create a SAML-based identity management provider in a central account and map IAM roles that provide the necessary permissions for users. Map users in the on-premises IdP groups to IAM roles. Use cross-account access to the other AWS accounts" is the correct answer.

INCORRECT: "Deploy the required IAM users, groups, roles, and policies in every AWS account. Create an AWS Organization and federate the on-premises identity management provider and the AWS accounts" is incorrect. This does not centralize the management of permissions and identities.

INCORRECT: "Create an AWS Organization with a management account that defines the SCPs for member accounts. Create a SAML-based identity management provider in each account and map users in the on-premises IdP groups to IAM roles" is incorrect. The SAML-based IdP should be mapped to the central account, not each individual account.

INCORRECT: "Create a SAML-based identity management provider in a central account and map IAM roles that provide the necessary permissions for users. Create a centralized AWS Lambda function that replicates the identities in the on-premises IdP groups to the AWS accounts" is incorrect. This does not centralize the control of permissions and identities and there could be several security issues with using this method.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Security, Identity, & Compliance

Question 20Skipped

An eCommerce company runs a workload on AWS that includes a web and application tier running on Amazon EC2 and a database tier running on Amazon RDS MySQL. The business requires a cost-efficient disaster recovery solution for the application with an RTO of 5 minutes and an RPO of 1 hour. The solution should ensure the primary and DR sites have a minimum distance of 150 miles between them.

Which of the following options could a Solutions Architect recommend to meet the company’s disaster recovery requirements?

Deploy a multi-Region solution ensuring the minimum distance requirements are met. Take regular snapshots of the web and application EC2 instances and replicate them to the DR Region. Launch an Amazon cross-Region read replica in the DR Region that can be promoted. Use AWS CloudFormation to launch the web and application tiers in the event of a disaster. Fail over the RDS DB to the standby instance and use Amazon Route 53 to switch traffic to the DR Region.

Correct answer

Deploy a scaled-down version of the production environment in a separate AWS Region ensuring the minimum distance requirements are met. The DR environment should include one instance for the web tier and one instance for the application tier. Create another database instance and configure source-replica replication for MySQL. Configure Auto Scaling for the web and app tiers to they can scale based on load. Use Amazon Route 53 to switch traffic to the DR Region.

Deploy a multi-Region solution ensuring the minimum distance requirements are met. The DR environment should include fully-functional web, application, and database tiers in both regions with equivalent capacity. Activate the primary database in one region only and the standby database in the other region. Use Amazon Route 53 to automatically switch traffic from one region to another using health check routing policies.

Deploy a multi-Region solution ensuring the minimum distance requirements are met. The DR environment should be configured using the pilot light strategy with database replication to a standby database with a minimum of capacity. Use AWS CloudFormation to launch web servers, application servers and load balancers in case of a disaster. Use Amazon Route 53 to switch traffic to the DR Region and vertically scale the Amazon RDS DB instance.

Overall explanation

A recovery time objective (RTO) of 5 minutes means the application must failover and be fully operational in the disaster recovery Region within 5 minutes. A recovery point objective (RPO) of 1 hour means that no more than 1 hour of data can be lost.

The 5 minute RTO is short and therefore it is important to have the database available and fully replicated and the ability to quickly launch additional instances to service the load. Ensuring that at least one instance of the app and web tiers is available will mean incoming connections that are routed by Route 53 (failover routing) will be service almost immediately.

For the database tier to be available and replicated that fastest option would be to use source-replica replication for MySQL and configure the failover process automatically (this could be done through scripting). RDS MySQL cross-region cannot be used in this case as the RTO would be at least 15 minutes.

CORRECT: "Deploy a scaled-down version of the production environment in a separate AWS Region ensuring the minimum distance requirements are met. The DR environment should include one instance for the web tier and one instance for the application tier. Create another database instance and configure source-replica replication for MySQL. Configure Auto Scaling for the web and app tiers to they can scale based on load. Use Amazon Route 53 to switch traffic to the DR Region" is the correct answer.

INCORRECT: "Deploy a multi-Region solution ensuring the minimum distance requirements are met. Take regular snapshots of the web and application EC2 instances and replicate them to the DR Region. Launch an Amazon cross-Region read replica in the DR Region that can be promoted. Use AWS CloudFormation to launch the web and application tiers in the event of a disaster. Fail over the RDS DB to the standby instance and use Amazon Route 53 to switch traffic to the DR Region" is incorrect.

This solution would require much more work to bring up and it is unlikely that it would be available within 5 minutes. AMIs would need to be created from the snapshots and then added to a new launch configuration for the Auto Scaling group before the web and application tiers could be launched. The RDS read replica would need to be promoted which can take several minutes and requires a reboot.

INCORRECT: "Deploy a multi-Region solution ensuring the minimum distance requirements are met. The DR environment should be configured using the pilot light strategy with database replication to a standby database with a minimum of capacity. Use AWS CloudFormation to launch web servers, application servers and load balancers in case of a disaster. Use Amazon Route 53 to switch traffic to the DR Region and vertically scale the Amazon RDS DB instance" is incorrect.

The pilot light does not have any instances running so they would need to be launched and the database would need to be scaled and rebooted. This process is likely to exceed the 5 minute RTO.

INCORRECT: "Deploy a multi-Region solution ensuring the minimum distance requirements are met. The DR environment should include fully-functional web, application, and database tiers in both regions with equivalent capacity. Activate the primary database in one region only and the standby database in the other region. Use Amazon Route 53 to automatically switch traffic from one region to another using health check routing policies" is incorrect.

This solution is less cost-effective though it does have the ability to meet the RTO and RPO requirements. There is question as to how the “standby” database would be configured and failed over that is not addressed.

References:

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_MySQL.Replication.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

Domain

AWS Database

Question 21Skipped

A company hosts a business-critical monolithic application on an Amazon EC2 instance which is installed on an instance launched from an Amazon Linux 2 AMI. The company requires that the data on the attached EBS volumes must be backed up to a specific Amazon S3 bucket managed by the company.

The security team has mandated against owning any SSH keys for instances, so the operations team are unable to SSH into the instance.

Which solution will meet these requirements with the least impact on the critical application?

Create an image of the instance with the reboot option turned on. Launch a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3.

Create a new AMI image from the current EC2 instance and spin up a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3.

Attach an IAM role to the instance with permissions to write to Amazon S3. Use the AWS Systems Manager Session Manager to gain access to the instance and run commands to copy data into Amazon S3.

Correct answer

Take a snapshot of the EBS volume by using Amazon Data Lifecycle Manager (Amazon DLM). Use the EBS direct APIs to copy the data from the snapshot to Amazon S3.

Overall explanation

Amazon Data Lifecycle Manager provides an automated, policy-based lifecycle management solution for Amazon Elastic Block Store (EBS) Snapshots and EBS-backed Amazon Machine Images (AMIs). Automate the creation of point-in-time copy of your block storage data with user-defined policies that you can customize based on data protection needs. Amazon Data Lifecycle Manager requires no scripting or special training.

You can use the Amazon Elastic Block Store (Amazon EBS) direct APIs to create EBS snapshots, write data directly to your snapshots, read data on your snapshots, and identify the differences or changes between two snapshots. These APIs can be used to read the data from the snapshot and copy the data to Amazon S3.

CORRECT: "Take a snapshot of the EBS volume by using Amazon Data Lifecycle Manager (Amazon DLM). Use the EBS direct APIs to copy the data from the snapshot to Amazon S3" is the correct answer (as explained above).

INCORRECT: "Attach an IAM role to the instance with permissions to write to Amazon S3. Use the AWS Systems Manager Session Manager to gain access to the instance and run commands to copy data into Amazon S3" is incorrect.

Running manual commands on a business-critical instance isn't recommended and DLM can safely take the snapshot without needing to log in to the instance in any way.

INCORRECT: "Create an image of the instance with the reboot option turned on. Launch a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3" is incorrect.

The reboot option will cause the business-critical application to be rebooted which has an impact on availability.

INCORRECT: "Create a new AMI image from the current EC2 instance and spin up a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3" is incorrect.

This is unnecessary as DLM can safely take a backup of the EBS volume using a snapshot.

References:

https://aws.amazon.com/blogs/storage/automating-amazon-ebs-snapshots-management-using-data-lifecycle-manager/

https://aws.amazon.com/ebs/data-lifecycle-manager/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-ebs/

Domain

AWS Storage

Question 22Skipped

A new employee is joining a security team. The employee initially requires access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. All security team members are added to the security team IAM group that provides additional permissions to manage all other AWS services.

The team lead wants to limit the permissions the new employee has access to until the employee takes on additional responsibilities, and then be able to easily add permissions as required, eventually providing the same access as all other security team employees.

How can the team lead limit the permissions assigned to the new user account whilst minimizing complexity?

Create an IAM account for the new employee. Create a new IAM group for the employee and add a permissions policy that grants access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add the additional services to the IAM policy.

Create an IAM account for the new employee in a dedicated account. Use cross-account access to manage resources. Limit the permissions on the cross-account access role to only allow management of Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add permissions to the cross-account access IAM role.

Correct answer

Create an IAM account for the new employee and add the account to the security team IAM group. Set a permissions boundary that grants access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add the additional services to the permissions boundary IAM policy.

Create an IAM account for the new employee and add the account to the security team IAM group. Use a Service Control Policy (SCP) to limit the maximum available permissions to Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, remove the SCP.

Overall explanation

AWS supports permissions boundaries for IAM entities (users or roles). A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. An entity's permissions boundary allows it to perform only the actions that are allowed by both its identity-based policies and its permissions boundaries.

In this case the permissions boundary means the user can remain in the security team IAM group. This will minimize complexity and set the configuration up for the future state where the user will have access to all privileges assigned to that group. In the meantime whilst the employee has limited responsibilities the permissions boundary can be used to limit the maximum available permissions.

This scenario is easy to implement and manage as a single policy statement can be updated with additional service permissions when required.

The diagram below depicts a similar scenario:

CORRECT: "Create an IAM account for the new employee and add the account to the security team IAM group. Set a permissions boundary that grants access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add the additional services to the permissions boundary IAM policy" is the correct answer.

INCORRECT: "Create an IAM account for the new employee. Create a new IAM group for the employee and add a permissions policy that grants access to manage Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add the additional services to the IAM policy" is incorrect. This will have the desired effect but will increase complexity as the employee must be moved to a separate IAM group to other team members until all permissions are assigned to the user and then moved back over.

INCORRECT: "Create an IAM account for the new employee and add the account to the security team IAM group. Use a Service Control Policy (SCP) to limit the maximum available permissions to Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, remove the SCP" is incorrect. SCPs control the maximum available permissions in an AWS account, not to individual user accounts.

INCORRECT: "Create an IAM account for the new employee in a dedicated account. Use cross-account access to manage resources. Limit the permissions on the cross-account access role to only allow management of Amazon DynamoDB, Amazon RDS, and Amazon CloudWatch. When the employee takes on new management responsibilities, add permissions to the cross-account access IAM role" is incorrect. This adds lots of complexity as the user is created in a separate account to other security team users.

References:

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Security, Identity, & Compliance

Question 23Skipped

A company is creating a secure data analytics solution. Data will be uploaded into an Amazon S3 bucket. The data will then be analyzed by applications running on an Amazon EMR cluster that is launched into a VPC in a private subnet. The environment must be fully isolated from the internet at all times. Data must be encrypted at rest using keys that are controlled and provided by the company.

Which combination of actions should a Solutions Architect take to meet these requirements? (Select TWO.)

Configure the EMR cluster to use an AWS KMS CMK for at-rest encryption. Configure a gateway VPC endpoint for Amazon S3 and a NAT gateway to access AWS KMS.

Correct selection

Configure the EMR cluster to use an AWS CloudHSM appliance for at-rest encryption. Configure a gateway VPC endpoint for Amazon S3.

Configure the EMR cluster to use an AWS KMS managed CMK for at-rest encryption. Configure a gateway VPC endpoint for Amazon S3 and an interface VPC endpoint for AWS KMS.

Correct selection

Configure the S3 bucket policy to permit access using an aws:sourceVpce condition to match the S3 endpoint ID.

Configure the S3 bucket policy to permit access to the Amazon EMR cluster only.

Overall explanation

The key requirements here are to isolate the environment from the Internet and to implement encryption at rest that uses keys that are BOTH provided by AND controlled by the company.

The capitalization above is to help you understand that there is an important distinction here. KMS provides control over encryption keys if you use customer-managed CMK - rather than an AWS managed CMK. CloudHSM uses keys that you both provide and control and it runs in your VPC.

This solution also includes using a gateway VPC endpoint for S3 and a bucket policy that restricts access to the gateway endpoint. This is the best way to ensure that traffic to the secure S3 bucket avoids the internet and is locked down to the correct source.

CORRECT: "Configure the EMR cluster to use an AWS CloudHSM appliance for at-rest encryption. Configure a gateway VPC endpoint for Amazon S3" is a correct answer.

CORRECT: "Configure the S3 bucket policy to permit access using an aws:sourceVpce condition to match the S3 endpoint ID" is also a correct answer.

INCORRECT: "Configure the EMR cluster to use an AWS KMS managed CMK for at-rest encryption. Configure a gateway VPC endpoint for Amazon S3 and an interface VPC endpoint for AWS KMS" is incorrect. This answer does not work as a KMS managed CMK does not allow control over the CMK (use a customer-managed CMK).

INCORRECT: "Configure the EMR cluster to use an AWS KMS CMK for at-rest encryption. Configure a gateway VPC endpoint for Amazon S3 and a NAT gateway to access AWS KMS" is incorrect. A NAT gateway uses the internet so this is not a valid solution for this scenario.

INCORRECT: "Configure the S3 bucket policy to permit access to the Amazon EMR cluster only" is incorrect. The bucket policy should restrict access to the VPC endpoint only, not the EMR cluster (there is no condition for EMR clusters).

References:

https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#master_keys

https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies-vpc-endpoint.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Security, Identity, & Compliance

Question 24Skipped

A Solutions Architect is designing a highly available infrastructure for a popular mobile application that offers games and videos for mobile phone users. The application runs on Amazon EC2 instances behind an Application Load Balancer. The database layer consist of an Amazon RDS MySQL Multi-AZ instance. The entire application stack is deployed across us-east-2 and us-west-1. Amazon Route 53 is configured to route traffic to the two deployments using a latency-based routing policy.

A testing team blocked access to the Amazon RDS DB instance in us-east-2 to verify that users who are typically directed to that deployment would be directed to us-west-1. This did not occur and users close to us-east-2 were directed there and the application failed.

Which changes to the infrastructure should a Solutions Architect make to resolve this issue? (Select TWO.)

Change to a failover routing policy in Amazon Route 53 and configure active-active failover. Write a custom health check the verifies successful access to the Application Load Balancers in each Region.

Correct selection

Write a custom health check that verifies successful access to the database endpoints in each Region. Add the health check within the latency-based routing policy in Amazon Route 53.

Set the value of Evaluate Target Health to Yes on the failover alias resources for both us-east-2 and us-west-1.

Write a custom health check that queries the AWS Service Dashboard API to verify the Amazon RDS service is healthy in each Region.

Correct selection

Set the value of Evaluate Target Health to Yes on the latency alias resources for both us-east-2 and us-west-1.

Overall explanation

The problem that is occurring is the database layer has failed (simulated) but the health checks (if there are any) are not checking access to the database. This can be resolved by creating a custom health check that connects to the RDS database endpoints in each Region and verifies that they are accessible. If a health check fails, Route 53 will no longer send any traffic to the deployment in that Region.

CORRECT: "Write a custom health check that verifies successful access to the database endpoints in each Region. Add the health check within the latency-based routing policy in Amazon Route 53" is a correct answer.

CORRECT: "Set the value of Evaluate Target Health to Yes on the latency alias resources for both us-east-2 and us-west-1" is also a correct answer.

INCORRECT: "Change to a failover routing policy in Amazon Route 53 and configure active-active failover. Write a custom health check the verifies successful access to the Application Load Balancers in each Region" is incorrect. Checking that the ALBs are accessible does not ensure that the database layer is accessible which is the problem in this scenario.

INCORRECT: "Write a custom health check that queries the AWS Service Dashboard API to verify the Amazon RDS service is healthy in each Region" is incorrect. This could return a result that shows that the RDS service is available but the specific endpoint might not be.

INCORRECT: "Set the value of Evaluate Target Health to Yes on the failover alias resources for both us-east-2 and us-west-1" is incorrect. There is no need to change to failover routing and this configuration would lose some of the performance benefits of latency-based routing.

References:

https://aws.amazon.com/blogs/aws/domain-name-health-checks-for-route-53/

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-values-latency.html#rrsets-values-latency-associate-with-health-check

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Question 25Skipped

A company runs an application on Amazon EC2 instances in an Amazon VPC and must access an external security analytics service that runs on an HTTPS REST API. The provider of the external API service can only grant access to a single source public IP address per customer.

Which configuration can be used to enable access to the API service using a single IP address without making modifications to the company’s application?

Correct answer

Launch the Amazon EC2 instances in a private subnet with an outbound route to a NAT gateway in a public subnet. Associate an Elastic IP address to the NAT gateway that can be whitelisted on the external API service.

Launch the Amazon EC2 instances in a private subnet. Configure HTTP_PROXY application parameters to send outbound connections to an EC2 proxy server in a public subnet. Associate an Elastic IP address to the EC2 proxy host that can be whitelisted on the external API service.

Launch the Amazon EC2 instances in a public subnet. Set the HTTPS_PROXY and NO_PROXY application parameters to send non-VPC outbound HTTPS connections to an EC2 proxy server deployed in a public subnet. Associate an Elastic IP address to the EC2 proxy host that can be whitelisted on the external API service.

Launch the Amazon EC2 instances in a public subnet with an internet gateway. Associate an Elastic IP address to the internet gateway that can be whitelisted on the external API service.

Overall explanation

The simplest solution is to use a NAT gateway in a public subnet that has an Elastic IP address assigned. This address can be whitelisted in the external API service as all connections will appear to come from the NAT gateway’s Elastic IP address.

CORRECT: "Launch the Amazon EC2 instances in a private subnet with an outbound route to a NAT gateway in a public subnet. Associate an Elastic IP address to the NAT gateway that can be whitelisted on the external API service" is the correct answer.

INCORRECT: "Launch the Amazon EC2 instances in a public subnet with an internet gateway. Associate an Elastic IP address to the internet gateway that can be whitelisted on the external API service" is incorrect. You cannot assign an Elastic IP address to an internet gateway.

INCORRECT: "Launch the Amazon EC2 instances in a private subnet. Configure HTTP_PROXY application parameters to send outbound connections to an EC2 proxy server in a public subnet. Associate an Elastic IP address to the EC2 proxy host that can be whitelisted on the external API service" is incorrect. Even if setup correctly, a NAT gateway will be a simpler solution to using an Amazon EC2 proxy instance and will not require any modifications to the company’s application.

INCORRECT: "Launch the Amazon EC2 instances in a public subnet. Set the HTTPS_PROXY and NO_PROXY application parameters to send non-VPC outbound HTTPS connections to an EC2 proxy server deployed in a public subnet. Associate an Elastic IP address to the EC2 proxy host that can be whitelisted on the external API service" is incorrect. This solution solves a problem in the previous answer by ensuring that VPC connections are not routed via the proxy but still requires application modification and introduces unnecessary complexity.

References:

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Compute

Question 26Skipped

A company has launched a web application on Amazon EC2 instances. The instances have been launched in a private subnet. An Application Load Balancer (ALB) is configured in front of the instances. The instances are assigned to a security group named WebAppSG and the ALB is assigned to a security group named ALB-SG. The security team requires that the security group rules are locked down according to best practice.

What rules should be configured in the security groups? (Select TWO.)

An inbound rule in ALB-SG allowing port 80 from WebAppSG.

An outbound rule in ALB-SG allowing ports 1024-65535 to destination 0.0.0.0/0.

Correct selection

An inbound rule in WebAppSG allowing port 80 from source ALB-SG.

An outbound rule in WebAppSG allowing ports 1024-65535 to destination ALB-SG.

Correct selection

An inbound rule in ALB-SG allowing port 80 from source 0.0.0.0/0.

Overall explanation

The most secure configuration that will allow the required traffic is as follows:

ALB-SG:

· Inbound rule to allow port 80 from 0.0.0.0/0.

· Outbound rule to allow port 80 to WebAppSG (and the health check port if different).

WebAppSG:

· Inbound rule to allow port 80 from the security group ID for ALB-SG.

· Outbound rules are not necessary as the response traffic to the ALB is allowed by default (may require rules for security updates etc.)

CORRECT: "An inbound rule in WebAppSG allowing port 80 from source ALB-SG" is a correct answer.

CORRECT: "An inbound rule in ALB-SG allowing port 80 from source 0.0.0.0/0" is also a correct answer.

INCORRECT: "An inbound rule in ALB-SG allowing port 80 from WebAppSG" is incorrect. The ALB does not receive traffic from the WebAppSG on port 80. The NLB receives incoming traffic from the internet clients on port 80 and response traffic from the EC2 instances on a high numbered port between 1024 and 65535.

INCORRECT: "An outbound rule in WebAppSG allowing ports 1024-65535 to destination ALB-SG" is incorrect. This is not required with a security group as they are stateful and response traffic is automatically allowed.

INCORRECT: "An outbound rule in ALB-SG allowing ports 1024-65535 to destination 0.0.0.0/0" is incorrect. As above, this is not required as security groups are stateful.

References:

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-update-security-groups.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/security-identity-compliance-sap/

Domain

AWS Networking & Content Delivery

Question 27Skipped

An eCommerce application offers a membership program. Members of the program need to be able to download all files in a secured Amazon S3 bucket. The access should be restricted to members of the program and not available to anyone else. An Amazon CloudFront distribution has been created to deliver the content to users around the world.

What is the most efficient method a Solutions Architect should use to securely enable access to the files in the S3 bucket?

Configure the application to generate a signed URL for authenticated users that provides time-limited access to the files.

Correct answer

Configure the application to send Set-Cookie headers to the viewer and control access to the files using signed cookies.

Use an Origin Access Identity (OAI) to control access to the S3 bucket to users of the CloudFront distribution only.

Configure a behavior in CloudFront that forwards requests for the files to the S3 bucket based on a path pattern.

Overall explanation

CloudFront signed cookies allow you to control who can access your content when you don't want to change your current URLs or when you want to provide access to multiple restricted files, for example, all of the files in the subscribers' area of a website.

When using signed cookies the application sends three Set-Cookie headers to the viewer and the viewer stores the name-value pairs and adds them to the requests using a Cookie header. Access is then controlled in CloudFront based on the cookies.

CORRECT: "Configure the application to send Set-Cookie headers to the viewer and control access to the files using signed cookies" is the correct answer.

INCORRECT: "Configure the application to generate a signed URL for authenticated users that provides time-limited access to the files" is incorrect. A signed URL is for access to an individual file, for multiple files a signed URL would be required for each file. In this case the signed cookies approach is more efficient.

INCORRECT: "Use an Origin Access Identity (OAI) to control access to the S3 bucket to users of the CloudFront distribution only" is incorrect. An OAI limits direct access to S3 to the CloudFront distribution only. In this case we also need a method to ensure that only the correct users of CloudFront are allowed access.

INCORRECT: "Configure a behavior in CloudFront that forwards requests for the files to the S3 bucket based on a path pattern" is incorrect. A path pattern controls where to send requests based on path or file type. This doesn’t really assist here as it doesn’t secure based on the user requesting access.

References:

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-choosing-signed-urls-cookies.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Storage

Question 28Skipped

A company needs to close a data center and must migrate data to AWS urgently. The data center has a 1 Gbps internet connection and a 500 Mbps AWS Direct Connect link. The company must transfer 25 TB of data from the data center to an Amazon S3 bucket.

What is the FASTEST method of transferring the data?

Copy the data to an 80 TB AWS Snowball device.

Use AWS DataSync to migrate the data to S3.

Correct answer

Upload the data to the S3 bucket using S3 Transfer Acceleration.

Use the AWS Direct Connect link to upload the data to S3.

Overall explanation

The fastest way to upload the data would be to use the higher speed internet connection and use Amazon S3 Transfer Acceleration.

Amazon S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between your client and an S3 bucket. Transfer Acceleration takes advantage of Amazon CloudFront’s globally distributed edge locations. As the data arrives at an edge location, data is routed to Amazon S3 over an optimized network path.

CORRECT: "Upload the data to the S3 bucket using S3 Transfer Acceleration" is the correct answer.

INCORRECT: "Use the AWS Direct Connect link to upload the data to S3" is incorrect. The Direct Connect link is slower than the internet link, with transfer acceleration latency can be reduced as the data is sent to the nearest edge location and then routed over the AWS global network.

INCORRECT: "Use AWS DataSync to migrate the data to S3" is incorrect. AWS DataSync will not improve the speed in this case whereas transfer acceleration will.

INCORRECT: "Copy the data to an 80 TB AWS Snowball device" is incorrect. With the internet link running at 1 Gbps and 25TB of data, the data can be moved quickly to AWS. Shipping snowball devices both ways will likely take longer.

References:

https://docs.aws.amazon.com/AmazonS3/latest/dev/transfer-acceleration.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-storage-sap/

Domain

AWS Storage

Question 29Skipped

An application is being tested for deployment in a Development account. The application consists of an Amazon API Gateway, Amazon EC2 instances behind an Elastic Load Balancer and an Amazon DynamoDB table. The Developers wish to grant a testing team access to deploy the application several times for performing a variety of acceptance tests but don’t want to grant broad permissions to each user. The Developers currently deploy the application using an AWS CloudFormation template and a role that has permission to the APIs for the included services.

How can a Solutions Architect meet the requirements for granting restricted access to the testing team so they can run their tests?

Upload the AWS CloudFormation template to Amazon S3. Give users in the testing team permission to use CloudFormation and S3 APIs with conditions that restrict the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.

Correct answer

Create an AWS Service Catalog product from the environment template and add a launch constraint to the product with the existing role. Give users in the testing team permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console.

Upload the AWS CloudFormation template to Amazon S3. Give users in the testing team permission to assume the Developer's role and add a policy that restricts the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.

Create an AWS Service Catalog product from the environment template and add a stack set constraint to the product with the existing role. Give users in the testing team permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console.

Overall explanation

A launch constraint specifies the AWS Identity and Access Management (IAM) role that AWS Service Catalog assumes when an end user launches a product. An IAM role is a collection of permissions that an IAM user or AWS service can assume temporarily to use AWS services.

Without a launch constraint, end users must launch and manage products using their own IAM credentials. To do so, they must have permissions for AWS CloudFormation, the AWS services used by the products, and AWS Service Catalog. By using a launch role, you can instead limit the end users' permissions to the minimum that they require for that product.

With this solution the testing team can be provided with access to launch the product from AWS Service Catalog for testing and the only privileges they will have are the privileges for actually deploying the product in service catalog.

CORRECT: "Create an AWS Service Catalog product from the environment template and add a launch constraint to the product with the existing role. Give users in the testing team permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console" is the correct answer.

INCORRECT: "Upload the AWS CloudFormation template to Amazon S3. Give users in the testing team permission to assume the Developer's role and add a policy that restricts the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console" is incorrect.

This limits permissions to the APIs required to launch the products but would also give the testing team the right to use those APIs outside of the service catalog product which the solution aims to avoid.

INCORRECT: "Create an AWS Service Catalog product from the environment template and add a stack set constraint to the product with the existing role. Give users in the testing team permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console" is incorrect.

A stack set constraint allows you to configure product deployment options using AWS CloudFormation StackSets. This is not required for this solution; a launch constraint should be used instead.

INCORRECT: "Upload the AWS CloudFormation template to Amazon S3. Give users in the testing team permission to use CloudFormation and S3 APIs with conditions that restrict the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console" is incorrect.

This is another solution that will give the testing team broad access to use the privileges to the service APIs outside of the defined use case which should be avoided.

References:

https://docs.aws.amazon.com/servicecatalog/latest/adminguide/constraints-launch.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-management-tools-sap/

Domain

AWS Management & Governance

Question 30Skipped

A rapidly growing company has registered 10 new domain names for multiple applications soon to be productionized. The company uses the domains for online marketing. The company needs a solution that will redirect online visitors to a specific URL and route combination for each domain. The URL and route combinations are defined in a JSON document. All DNS records are managed by Amazon Route 53. They also need to accept HTTP and HTTPS requests.

Which combination of steps should a solutions architect take to meet these requirements with the LEAST amount of operational effort? (Select THREE.)

Correct selection

Create an SSL certificate by using AWS Certificate Manager (ACM). Include the domains as Subject Alternative Names.

Correct selection

Create an Amazon CloudFront distribution and deploy a Lambda@Edge function.

Use an Amazon API Gateway API with a custom domain to publish an AWS Lambda function.

Create an AWS Lambda function that uses the event message and specified JSON document to look up and respond with a redirect URL.

Correct selection

Create an Application Load Balancer that includes HTTP and HTTPS listeners.

Create a dynamic webpage and host it on an Amazon EC2 instance. Configure the webpage to use the JSON document in combination with the event message to look up and respond with a redirect URL.

Overall explanation

Lambda@Edge allows you to execute custom business logic closer to the viewer. This capability enables intelligent/programmable processing of HTTP requests at locations that are closer (for the purpose of latency) to your viewer. In this case the Lambda@Edge function can be written so that it redirects viewers based on information in the request based on domain and path.

To accept multiple custom domains on the CloudFront distribution a certificate can be created in ACM that includes multiple subject alternative names. These names can then be used in Route 53 records pointing to the distribution.

The ALB may will need to be configured with both an HTTP and an HTTPS listener. The HTTPS listener will also require a certificate, and this could use the same certificate used in the CloudFront distribution or it could be a separate certificate.

CORRECT: "Create an Application Load Balancer that includes HTTP and HTTPS listeners" is a correct answer (as explained above.)

CORRECT: "Create an Amazon CloudFront distribution and deploy a Lambda@Edge function" is also a correct answer (as explained above.)

CORRECT: "Create an SSL certificate by using AWS Certificate Manager (ACM). Include the domains as Subject Alternative Names" is also a correct answer (as explained above.)

INCORRECT: "Create a dynamic webpage and host it on an Amazon EC2 instance. Configure the webpage to use the JSON document in combination with the event message to look up and respond with a redirect URL" is incorrect.

While designing such a solution, serverless should be utilized and hence EC2 isn’t an appropriate use case for this scenario.

INCORRECT: "Create an AWS Lambda function that uses the event message and specified JSON document to look up and respond with a redirect URL" is incorrect.

With this solution, Lambda would need a change every time config file changes and would increase effort, hence this is not an efficient option.

INCORRECT: "Use an Amazon API Gateway API with a custom domain to publish an AWS Lambda function" is incorrect.

With this option as well, for each domain addition or change, API gateway stages would have to be re deployed hence this is again an ineffective choice.

References:

https://aws.amazon.com/premiumsupport/knowledge-center/elb-redirect-to-another-domain-with-alb/

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-how-it-works-tutorial.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-cloudfront/

Domain

AWS Networking & Content Delivery

Question 31Skipped

A company is planning to migrate 30 small applications to AWS. The applications run on a mixture of Node.js and Python across a cluster of virtual servers on-premises. The company must minimize costs and standardize on a single deployment methodology for all applications. The applications have various usage patterns but generally have a low number of concurrent users. The applications use an average usage of 1 GB of memory with up to 3 GB during peak processing periods which can last several hours.

What is the MOST cost effective solution for these requirements?

Migrate the applications to Amazon EC2 instances in Auto Scaling groups. Create separate target groups for each application behind an Application Load Balancer and use host-based routing. Configure Auto Scaling to scale based on memory utilization and set the threshold to 75%.

Migrate the applications to separate AWS Elastic Beanstalk environments. Enable Auto Scaling to ensure there are sufficient resources during peak processing periods. Monitor each AWS Elastic Beanstalk deployment with using CloudWatch alarms.

Migrate the applications to run on AWS Lambda with a separate function for each application. Use AWS CloudTrail logs and Amazon CloudWatch alarms to verify completion of important processes.

Correct answer

Migrate the applications to Docker containers on Amazon ECS. Create a separate ECS task and service for each application. Enable service Auto Scaling based on memory utilization and set the threshold to 75%. Monitor services and hosts by using Amazon CloudWatch.

Overall explanation

This is a good use case for Docker containers as the applications are small, need to scale based on memory usage, and have processes running that last several hours. Amazon ECS publishes CloudWatch metrics with your service’s average CPU and memory usage and this can be used with Service Auto Scaling to increase or decrease the desired count of tasks in the Amazon ECS service automatically.

The diagram below shows the components of an ECS cluster using the EC2 launch type.

CORRECT: "Migrate the applications to Docker containers on Amazon ECS. Create a separate ECS task and service for each application. Enable service Auto Scaling based on memory utilization and set the threshold to 75%. Monitor services and hosts by using Amazon CloudWatch" is the correct answer.

INCORRECT: "Migrate the applications to run on AWS Lambda with a separate function for each application. Use AWS CloudTrail logs and Amazon CloudWatch alarms to verify completion of important processes" is incorrect. The peak processing periods run for several hours so this is going to rule out AWS Lambda which has a maximum execution time of 900 seconds.

INCORRECT: "Migrate the applications to separate AWS Elastic Beanstalk environments. Enable Auto Scaling to ensure there are sufficient resources during peak processing periods. Monitor each AWS Elastic Beanstalk deployment with using CloudWatch alarms" is incorrect. This will be less cost-efficient than using ECS Tasks.

INCORRECT: "Migrate the applications to Amazon EC2 instances in Auto Scaling groups. Create separate target groups for each application behind an Application Load Balancer and use host-based routing. Configure Auto Scaling to scale based on memory utilization and set the threshold to 75%" is incorrect. You cannot scale EC2 based on memory utilization unless you configure a custom metric in CloudWatch. This is also less cost-effective than using ECS tasks.

References:

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service-auto-scaling.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-compute-sap/

Domain

AWS Compute

Question 32Skipped

An eCommerce company runs an application that records product registration information. The application uses an Amazon S3 bucket for storing files and an Amazon DynamoDB table to store customer record data. The application software runs in us-west-1 and eu-central-1. The S3 bucket and DynamoDB table are in us-west-1. A Solutions Architect has been asked to implement protection from data corruption and the loss of connectivity to either Region.

Which solution meets these requirements?

Create an AWS Lambda function triggered by Amazon CloudWatch Events to make regular backups of the DynamoDB table. Set up S3 cross-region replication from us-west-1 to eu-central-1. Set up MFA delete on the S3 bucket in us-west-1.

Correct answer

Create a DynamoDB global table to replicate data between us-west-1 and eu-central-1. Enable continuous backup on the DynamoDB table in us-west-1 . Set up S3 cross-region replication from us-west-1 to eu-central-1.

Create a DynamoDB global table to replicate data between us-west-1 and eu-central-1. Enable versioning on the S3 bucket. Implement strict ACLs on the S3 bucket.

Create a DynamoDB global table to replicate data between us-west-1 and eu-central-1. Enable continuous backup on the DynamoDB table in us-west-1 . Enable versioning on the S3 bucket.

Overall explanation

A DynamoDB global table is a multi-region, multi-active database. This means you can create a table and write to that table in multiple Regions and AWS synchronizes the items. This provides the required redundancy for the database table. DynamoDB continuous backups can be enabled. This provides per-second granularity and restore to any single second from the time PITR was enabled up to the prior 35 days. This protects against data corruption.

For Amazon S3 you can enable cross-Region replication which requires versioning is enabled. This provides synchronization of changes and also versioning history in case of data corruption.

CORRECT: "Create a DynamoDB global table to replicate data between us-west-1 and eu-central-1. Enable continuous backup on the DynamoDB table in us-west-1 . Set up S3 cross-region replication from us-west-1 to eu-central-1" is the correct answer.

INCORRECT: "Create an AWS Lambda function triggered by Amazon CloudWatch Events to make regular backups of the DynamoDB table. Set up S3 cross-region replication from us-west-1 to eu-central-1. Set up MFA delete on the S3 bucket in us-west-1" is incorrect. There’s no need to use Lambda when you can just enable continuous backups.. MFA delete will not protect against data corruption.

INCORRECT: "Create a DynamoDB global table to replicate data between us-west-1 and eu-central-1. Enable continuous backup on the DynamoDB table in us-west-1 . Enable versioning on the S3 bucket" is incorrect. Versioning will help with data corruption but there’s no solution here to replicate the data to another Region.

INCORRECT: "Create a DynamoDB global table to replicate data between us-west-1 and eu-central-1. Enable versioning on the S3 bucket. Implement strict ACLs on the S3 bucket" is incorrect. ACLs cannot protect against data corruption and there’s no solution for protecting the data in the DynamoDB table from corruption here.

References:

https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GlobalTables.html

https://aws.amazon.com/blogs/aws/new-amazon-dynamodb-continuous-backups-and-point-in-time-recovery-pitr/

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-database-sap/

Domain

AWS Database

Question 33Skipped

A company which recently moved to AWS is trying to build a hybrid DNS solution. An AWS Direct Connect (DX) connection between the on-premises corporate network and an AWS Transit Gateway is established.

This solution will use an Amazon Route 53 private hosted zone for the domain internal.company.local for the resources stored within Amazon VPCs. The company has the following DNS resolution requirements:

· On-premises systems should be able to resolve and connect to internal.company.local.

· All VPCs should be able to resolve internal.company.local.

Which architecture should the company use to meet these requirements with the HIGHEST performance?

Correct answer

Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for internal.company.local that point to the inbound resolver.

Associate the private hosted zone to the shared services VPC. Create a Route 53 outbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for internal.company.local that point to the outbound resolver.

Associate the private hosted zone to all the VPCs. Deploy an Amazon EC2 conditional forwarder in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for internal.company.local that point to the conditional forwarder.

Associate the private hosted zone to the shared services VPC. Create a Route 53 inbound resolver in the shared services VPC. Attach the shared services VPC to the transit gateway and create forwarding rules in the on- premises DNS server for internal.company.local that point to the inbound resolver.

Overall explanation

With an inbound Route 53 resolver the DNS servers in the on-premises network will forward queries for the custom domain name to the inbound resolver endpoint. The private hosted zone for cloud.example.com is associated with the VPC and will provide responses to DNS queries. For routing traffic, the VPCs must be attached to the transit gateway.

CORRECT: "Associate the private hosted zone to all the VPCs. Create a Route 53 inbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for internal.company.local that point to the inbound resolver" is the correct answer (as explained above.)

INCORRECT: "Associate the private hosted zone to all the VPCs. Deploy an Amazon EC2 conditional forwarder in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for internal.company.local that point to the conditional forwarder" is incorrect.

Since Route 53 provides an inbound resolver, adding EC2 would add cost and extra effort.

INCORRECT: "Associate the private hosted zone to the shared services VPC. Create a Route 53 outbound resolver in the shared services VPC. Attach all VPCs to the transit gateway and create forwarding rules in the on-premises DNS server for internal.company.local that point to the outbound resolver" is incorrect.

When associating on-premises DNS server, the inbound resolver needs to be added to the forwarding rules which acts as a destination for the traffic hence this is an incorrect option.

INCORRECT: "Associate the private hosted zone to the shared services VPC. Create a Route 53 inbound resolver in the shared services VPC. Attach the shared services VPC to the transit gateway and create forwarding rules in the on- premises DNS server for internal.company.local that point to the inbound resolver" is incorrect.

Although it is possible to use forwarding rules to resolve private hosted zones in other VPCs, the most reliable, performant, and low-cost approach is to share and associate private hosted zones directly to all VPCs that need them.

References:

https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-dns-management-of-hybrid-cloud-with-amazon-route-53-and-aws-transit-gateway/

Save time with our AWS cheat sheets:

https://digitalcloud.training/amazon-route-53/

Domain

AWS Networking & Content Delivery

Question 34Skipped

A finance organization runs a data processing application in an on-premises data center. The application processes input files that are uploaded by users upload through a web portal. A web server stores the uploaded files on a shared NFS storage appliance and messages the processing server over a message queue. The input files can take up to 1 hour to process and the number of files awaiting processing can be high during business hours and drops outside of business hours.

Which of the following is the MOST cost-effective migration recommendation?

Correct answer

Create an Amazon SQS queue. Configure the existing web server to publish to the new queue. Use Amazon EC2 instances in an EC2 Auto Scaling group to pull requests from the queue and process the files. Scale the EC2 instances based on the SQS queue length. Store the processed files in an Amazon S3 bucket.

Create an Amazon MQ queue. Configure the existing web server to publish to the new queue. When there are messages in the queue, create a new Amazon EC2 instance to pull requests from the queue and process the files. Store the processed files in Amazon EFS. Shut down the EC2 instance after the task is complete.

Create an Amazon MQ queue. Configure the existing web server to publish to the new queue. When there are messages in the queue, invoke an AWS Lambda function to pull requests from the queue and process the files. Store the processed files in Amazon EFS.

Create an Amazon SQS queue. Configure the existing web server to publish to the new queue. When there are messages in the queue, invoke an AWS Lambda function to pull requests from the queue and process the files. Store the processed files in an Amazon S3 bucket.

Overall explanation

For the scenarios where the number of input requests varies and asynchronous behavior is intended, AWS SQS fits the use case, since SQS depth can be used as a trigger to scale up or down the number of consumer instances. The EC2 instances are part of an Auto Scaling group and will therefore scale based on the application demand. This scenario exactly fits the requirement and is the most cost-effective option as it uses auto scaling and a serverless message queue.

The diagram below depicts this solution:

CORRECT: "Create an Amazon SQS queue. Configure the existing web server to publish to the new queue. Use Amazon EC2 instances in an EC2 Auto Scaling group to pull requests from the queue and process the files. Scale the EC2 instances based on the SQS queue length. Store the processed files in an Amazon S3 bucket" is the correct answer (as explained above.)

INCORRECT: "Create an Amazon SQS queue. Configure the existing web server to publish to the new queue. When there are messages in the queue, invoke an AWS Lambda function to pull requests from the queue and process the files. Store the processed files in an Amazon S3 bucket" is incorrect.

Due to higher processing times of bigger files, Lambda may be subjected to timeout and might not be effective. Remember that Lambda has a maximum processing time of 900 seconds.

INCORRECT: "Create an Amazon MQ queue. Configure the existing web server to publish to the new queue. When there are messages in the queue, create a new Amazon EC2 instance to pull requests from the queue and process the files. Store the processed files in Amazon EFS. Shut down the EC2 instance after the task is complete" is incorrect.

Auto scaling would be preferable to shutting down EC2 instances after processing completes. EFS will also be less cost-effective compared to using Amazon S3.

INCORRECT: "Create an Amazon MQ queue. Configure the existing web server to publish to the new queue. When there are messages in the queue, invoke an AWS Lambda function to pull requests from the queue and process the files. Store the processed files in Amazon EFS" is incorrect.

This is also an incorrect option since Lambda might timeout due to higher processing times. Also, EFS is not the most cost-effective storage option.

References:

https://docs.aws.amazon.com/autoscaling/ec2/userguide/as-using-sqs-queue.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/aws-application-integration-services/

Domain

AWS Application Integration

Question 35Skipped

A Solutions Architect must design a solution for providing private connectivity from a company’s WAN network to multiple AWS Regions. The company has offices around the world and has its main data center in New York. The company has mandated that traffic must not traverse the public internet at any time. The solution must also be highly available.

How can the Solutions Architect meet these requirements?

Create an AWS Direct Connect connection from the New York data center to all AWS Regions the company uses. Configure the company WAN to send traffic via the New York data center and on to the respective DX connection to access AWS.

Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use inter-region VPC peering to access the data in other AWS Regions.

Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use an AWS transit VPC solution to access data in other AWS Regions.

Correct answer

Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use Direct Connect Gateway to access data in other AWS Regions.

Overall explanation

This is a great use case for DX gateway which allows you to connect either a transit gateway, or a virtual private gateway. The DX gateway will then allow you to establish connections to multiple AWS Regions. For high availability this solution should have two DX connections from the New York data center and the WAN should then be configured through BGP to forwarded connections to AWS across the DX connections.

CORRECT: "Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use Direct Connect Gateway to access data in other AWS Regions" is the correct answer.

INCORRECT: "Create an AWS Direct Connect connection from the New York data center to all AWS Regions the company uses. Configure the company WAN to send traffic via the New York data center and on to the respective DX connection to access AWS" is incorrect. You would not want to connect multiple AWS Regions to a single data center using DX connections as this would be very expensive and is not necessary. It’s better to connect to a local Region and then use DX gateway / transit gateway for connectivity from there.

INCORRECT: "Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use inter-region VPC peering to access the data in other AWS Regions" is incorrect. Inter-region VPC peering becomes very complex to setup when you have many Regions to connect in a transitive relationship (no transitive peering).

INCORRECT: "Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use an AWS transit VPC solution to access data in other AWS Regions" is incorrect. A transit VPC is a VPC configured to perform routing to other VPCs in a hub and spoke model. This has largely been replaced by transit gateways. In this case, we are using multiple Regions so the DX gateway must be used to connect across Regions.

References:

https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html

Save time with our AWS cheat sheets:

https://digitalcloud.training/category/aws-cheat-sheets/aws-solutions-architect-professional/aws-networking-content-delivery-sap/

Domain

AWS Networking & Content Delivery

Back to result overview Scroll back to top

Continue
Retake test

Fullscreen

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Progress cannot be changed for this item

Expanded view

Beta

0 / 10used queries